General
- Target jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.d32f1e0e8e691713f444725d12aa7a71
- Size 170KB
- Sample261018-sl48xabe47
- SHA256 822aaaf6e91c564edfa90730a71c2b8e43fb32cba803b2debb8e3163c773d790
- MD5 d32f1e0e8e691713f444725d12aa7a71
- SHA1 6645af2d639590b296a7008ab9a1f78092fdcce7
- SHA512 0d7920fc60fd2d04fa9b3b451a8ea4ea0b814eb7b021a6079f133afa6878cdf3fdc1fd687707382e6861e589548193e83dbc58464f773f43932bb7011b33791b
- SSDEEP 3072:o9XAuw8ukQAjfyQIHfW2lKU/yrKKrDLiCfsQH:oqu62j6QAfW2ln/GKKrDLFB
- TLSH T1ED0402729540E247F1F543B9A563D571B61AB1EBC3E016F15EE902EA37B1A1F04233E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
Resource
win10v2004-20260911-en
Malware Config
Extracted
-
cycbot
-
http://maildbaccess.com
-
http://mediadryvers.com
-
http://kinderjoys.com
-
http://milkiwals.com
-
http://ourrepolists.com
-
http://torrentclist.com
-
http://ourhelpsme.com
-
http://snikersonline.com
-
http://laporoskopia.com
-
http://freewhoisdb.com
-
http://sslprogrammingshool.com
-
http://ddossecureonline.com
-
http://sambukaclubonline.com
-
http://hlamidioz.com
-
payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg
http://crazyleafdesign.com/blog/images/share/stumble.png
http://crazyleafdesign.com/blog/images/share/facebook.png
http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1
http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2
http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg
http://psfk.com/img/icons/twitter.png
http://psfk.com/img/icons/facebook.png
http://healthylifenow.com/templates/7348/images/header_logo.jpg
http://healthylifenow.com/templates/7349/images/header_logo.jpg
http://hollandandbarrett.com/images/footer/account.jpg
http://hollandandbarrett.com/images/footer/account.gif
http://nationsautoelectric.com/images/50-217-1_F_1_.jpg
http://nationsautoelectric.com/images/50-217-1_F_2_.jpg
http://onlinebizdirectory.com/images/PowerShowBanner.gif
http://onlinebizdirectory.com/images/PowerHideBanner.gif
http://lostpropaganda.net/blog/pics/3321.jpg
http://lostpropaganda.net/blog/pics/3322.jpg
http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif
http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif
http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif
http://onlineinstitute.com/g7/images/logo.jpg
http://onlineinstitute.com/g7/images/logo2.jpg
http://onlineinstitute.com/g7/images/logo3.jpg
http://onlineinstitute.com/g7/images/logo4.jpg
http://onlinedatingsecretfriends.com/images/im133.jpg
http://onlinedatingsecretfriends.com/images/im134.jpg
Targets
-
- Target jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.d32f1e0e8e691713f444725d12aa7a71
- Size 170KB
- SHA256 822aaaf6e91c564edfa90730a71c2b8e43fb32cba803b2debb8e3163c773d790
- MD5 d32f1e0e8e691713f444725d12aa7a71
- SHA1 6645af2d639590b296a7008ab9a1f78092fdcce7
- SHA512 0d7920fc60fd2d04fa9b3b451a8ea4ea0b814eb7b021a6079f133afa6878cdf3fdc1fd687707382e6861e589548193e83dbc58464f773f43932bb7011b33791b
- SSDEEP 3072:o9XAuw8ukQAjfyQIHfW2lKU/yrKKrDLiCfsQH:oqu62j6QAfW2ln/GKKrDLFB
- TLSH T1ED0402729540E247F1F543B9A563D571B61AB1EBC3E016F15EE902EA37B1A1F04233E8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Cycbot payload
Cycbot is a backdoor and trojan written in C++.