General
- Target jaffacakes118_Backdoor.Win32.Gbot.ihh.dcd973b1ad72caf602f7b24bb1234cc6
- Size 176KB
- Sample261014-grckasgv8v
- SHA256 1dd6efd591dc04d03b8158399428edb055db18c556f088b4d453fb240b27d407
- MD5 dcd973b1ad72caf602f7b24bb1234cc6
- SHA1 f8692cc0e79e24af6591a67a29db97ff565544fe
- SHA512 d8b8fca0e452b1e6a345812d836a859f112dda5b88a90c7ea1d5fe575bffc0ca62a058f0bfd4de875abd5735436234b9c8cb8b30ded79cd304fd430fc38defab
- SSDEEP 3072:gOVv7ErfyAzUU1Ws/GBMExDQ1LkrZOxyK0yb30gWn6ecNgNdQ6ToL3pGZMyFpq:gOFwfyAzUUT/AMOD+LeZ8bEn0iN26TQS
- TLSH T1E70402E67491424FF5F606386533E870B3ACC59E9BE408DA2F8192F5773626E98133D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_Backdoor.Win32.Gbot.ihh.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://maildbaccess.com
-
http://mediadryvers.com
-
http://kinderjoys.com
-
http://milkiwals.com
-
http://ourrepolists.com
-
http://torrentclist.com
-
http://ourhelpsme.com
-
http://snikersonline.com
-
http://laporoskopia.com
-
http://freewhoisdb.com
-
http://sslprogrammingshool.com
-
http://ddossecureonline.com
-
http://sambukaclubonline.com
-
http://hlamidioz.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118_Backdoor.Win32.Gbot.ihh.dcd973b1ad72caf602f7b24bb1234cc6
- Size 176KB
- SHA256 1dd6efd591dc04d03b8158399428edb055db18c556f088b4d453fb240b27d407
- MD5 dcd973b1ad72caf602f7b24bb1234cc6
- SHA1 f8692cc0e79e24af6591a67a29db97ff565544fe
- SHA512 d8b8fca0e452b1e6a345812d836a859f112dda5b88a90c7ea1d5fe575bffc0ca62a058f0bfd4de875abd5735436234b9c8cb8b30ded79cd304fd430fc38defab
- SSDEEP 3072:gOVv7ErfyAzUU1Ws/GBMExDQ1LkrZOxyK0yb30gWn6ecNgNdQ6ToL3pGZMyFpq:gOFwfyAzUUT/AMOD+LeZ8bEn0iN26TQS
- TLSH T1E70402E67491424FF5F606386533E870B3ACC59E9BE408DA2F8192F5773626E98133D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.