cycbot | 7854ce8c1ec761885f6636aac242a100a2f5f2b1493212082498c771130e408a

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.e0a39c7333df8bf03039fa2f7f600c3a
Size 181KB
Sample261016-hpd6saay7t
SHA256 7854ce8c1ec761885f6636aac242a100a2f5f2b1493212082498c771130e408a
MD5 e0a39c7333df8bf03039fa2f7f600c3a
SHA1 a0254ec2d21f160a30e78e041c1560d376ba3cd5
SHA512 ff3f1316617cef657f070155b20202c43befdf227fe306716f6b9a0c400b425ad20cdc246593297fb6014c1cc503b4679a1e93d79bad9632341d4f95a4254d6c
SSDEEP 3072:WJ8gx8IGWseWVfVJmn8sEr9TY5Zu7zMJipB6/FLRVsvX/GVEBvH7pBcHCVuH:9t2ysEr9TEu3PQ9LRODQCEH
TLSH
T1F10401A56633E48DD3B184343CD9F619030EA053B5A64CAA7FE08AE77380B11757F6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

C2

http://worldmotoblo.com
http://resetmymemory.com
http://fastblogportal.com
http://freshmediaportal.com
http://yourimagearchive.com
http://myblogstoyou.com
http://stotre4image.com
http://allsoft4you.com
http://videocontainer.com
http://maxtroeurosys.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.e0a39c7333df8bf03039fa2f7f600c3a
- Size 181KB
- SHA256 7854ce8c1ec761885f6636aac242a100a2f5f2b1493212082498c771130e408a
- MD5 e0a39c7333df8bf03039fa2f7f600c3a
- SHA1 a0254ec2d21f160a30e78e041c1560d376ba3cd5
- SHA512 ff3f1316617cef657f070155b20202c43befdf227fe306716f6b9a0c400b425ad20cdc246593297fb6014c1cc503b4679a1e93d79bad9632341d4f95a4254d6c
- SSDEEP 3072:WJ8gx8IGWseWVfVJmn8sEr9TY5Zu7zMJipB6/FLRVsvX/GVEBvH7pBcHCVuH:9t2ysEr9TEu3PQ9LRODQCEH
- TLSH
  T1F10401A56633E48DD3B184343CD9F619030EA053B5A64CAA7FE08AE77380B11757F6E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2