General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.f3fd3055ff64410073f98bd7dad64b98
- Size 162KB
- Sample261014-jftqjsys3m
- SHA256 9a9b75e6b90f4442146b16ad9904e0bbc61b1cd936d27aaf7900f90f45878322
- MD5 f3fd3055ff64410073f98bd7dad64b98
- SHA1 001767ecf6a0306757416845cf6d356cf5308e32
- SHA512 540c7f2958e6a0f1a8d571f45211c8f24803b84bf474fe5bf250749402340ef905721603bd68f8e3862b5ed0ea357e4052bc268074942ee60081893642190cd5
- SSDEEP 3072:zVDpM4dVPmYP+TUEZ882ifJ1oEijsZmidm9/3EhrcL9hBPQFE1fHu:A47PmG+JZligQidBtg9hpQFQf
- TLSH T1E9F3F1A99273C66AF3746978BED9D2A803BA14FF39841C5B36E082FD7615488F4370D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://renamesys5.com
-
http://givishoolstome.com
-
http://limfoklubs.com
-
http://regfeedbackaccess.com
-
http://umbrella-systems1.com
-
http://monymouses.com
-
http://onlinepdahelpforyou.com
-
http://remarkreddomas.com
-
http://transfersakkonline.com
-
http://backupdomaintolevel.com
-
payload_url
http://armoredlegion.com/305986.png
http://armoredlegion.com/16354.png
http://armoredlegion.com/716354_m61.png
http://mektek.net/thelab/wiley.jpg
http://knowledgesutra.com/img/temp/hi.cgi
http://knowledgesutra.com/img/temp/head.png
http://battleon.com/134.gif
http://battleon.com/132.gif
http://battleon.com/133.gif
http://browsermmorpg.com/images/cpc.png
http://browsermmorpg.com/images/cpc2.png
http://browsermmorpg.com/img/intel.gif
http://browsermmorpg.com/img/intel.jpg
http://012webpages.com/christian12.jpg
http://012webpages.com/christian13.jpg
http://012webpages.com/christian14.jpg
http://tri-countymech.com/g/livechat.png
http://tri-countymech.com/g/logo.png
http://tri-countymech.com/g/133.jpg
http://tri-countymech.com/g/134.jpg
http://electronicstheory.com/pics/valley.png
http://electronicstheory.com/pics/sun.png
http://classicbattletech.com/lhous3.gif
http://classicbattletech.com/lhous4.gif
http://classicbattletech.com/lhous5.gif
http://classicbattletech.com/lhous6.gif
http://engineeringcrossing.com/images/misc/23525.png
http://engineeringcrossing.com/images/misc/64646.png
http://%s/s.php?c=121&id=%s
http://xprstats.com/images/logo.png
Targets
-
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.f3fd3055ff64410073f98bd7dad64b98
- Size 162KB
- SHA256 9a9b75e6b90f4442146b16ad9904e0bbc61b1cd936d27aaf7900f90f45878322
- MD5 f3fd3055ff64410073f98bd7dad64b98
- SHA1 001767ecf6a0306757416845cf6d356cf5308e32
- SHA512 540c7f2958e6a0f1a8d571f45211c8f24803b84bf474fe5bf250749402340ef905721603bd68f8e3862b5ed0ea357e4052bc268074942ee60081893642190cd5
- SSDEEP 3072:zVDpM4dVPmYP+TUEZ882ifJ1oEijsZmidm9/3EhrcL9hBPQFE1fHu:A47PmG+JZligQidBtg9hpQFQf
- TLSH T1E9F3F1A99273C66AF3746978BED9D2A803BA14FF39841C5B36E082FD7615488F4370D1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.
-
Modifies WinLogon for persistence