cycbot | 6ea902ac49a964f415d39085240ee6c5d33b20b1514176808db87a4baddef6c2

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.6b51dd04bf16cc9b5f25632db474e473
Size 170KB
Sample261014-hsftsaxy6p
SHA256 6ea902ac49a964f415d39085240ee6c5d33b20b1514176808db87a4baddef6c2
MD5 6b51dd04bf16cc9b5f25632db474e473
SHA1 b55e0d8a973140ff5148764d89fb5376e5117ba0
SHA512 1d8077d6fe74b9e60feb8779dbfe9fabeadf34389e6119f0ee247f0124b5797a3afd4e74bd26c0a57a275bccf99920225209d27545101562112e27370e6a422f
SSDEEP 3072:nvjsDPkE5fCERyXXK7Djx4NFsHHqbQhKrdJijrXsAt5TPimxBqjGjEB3k4F:nQ7kE5fCE0qbx4NenYe2wHssBxkjkEBZ
TLSH
T13604F1C6A3B2EE3CE3B87171601146722B2C7326F1185FCEB769D63DB56F491830A291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.6b51dd04bf16cc9b5f25632db474e473
- Size 170KB
- SHA256 6ea902ac49a964f415d39085240ee6c5d33b20b1514176808db87a4baddef6c2
- MD5 6b51dd04bf16cc9b5f25632db474e473
- SHA1 b55e0d8a973140ff5148764d89fb5376e5117ba0
- SHA512 1d8077d6fe74b9e60feb8779dbfe9fabeadf34389e6119f0ee247f0124b5797a3afd4e74bd26c0a57a275bccf99920225209d27545101562112e27370e6a422f
- SSDEEP 3072:nvjsDPkE5fCERyXXK7Djx4NFsHHqbQhKrdJijrXsAt5TPimxBqjGjEB3k4F:nQ7kE5fCE0qbx4NenYe2wHssBxkjkEBZ
- TLSH
  T13604F1C6A3B2EE3CE3B87171601146722B2C7326F1185FCEB769D63DB56F491830A291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2