cycbot | 822aaaf6e91c564edfa90730a71c2b8e43fb32cba803b2debb8e3163c773d790

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
Size 170KB
Sample261018-sl48xabe47
SHA256 822aaaf6e91c564edfa90730a71c2b8e43fb32cba803b2debb8e3163c773d790
MD5 d32f1e0e8e691713f444725d12aa7a71
SHA1 6645af2d639590b296a7008ab9a1f78092fdcce7
SHA512 0d7920fc60fd2d04fa9b3b451a8ea4ea0b814eb7b021a6079f133afa6878cdf3fdc1fd687707382e6861e589548193e83dbc58464f773f43932bb7011b33791b
SSDEEP 3072:o9XAuw8ukQAjfyQIHfW2lKU/yrKKrDLiCfsQH:oqu62j6QAfW2ln/GKKrDLFB
TLSH
T1ED0402729540E247F1F543B9A563D571B61AB1EBC3E016F15EE902EA37B1A1F04233E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery cycbot rat upx

Malware Config

Extracted

Family

cycbot

http://maildbaccess.com
http://mediadryvers.com
http://kinderjoys.com
http://milkiwals.com
http://ourrepolists.com
http://torrentclist.com
http://ourhelpsme.com
http://snikersonline.com
http://laporoskopia.com
http://freewhoisdb.com
http://sslprogrammingshool.com
http://ddossecureonline.com
http://sambukaclubonline.com
http://hlamidioz.com

Attributes

payload_url
http://monochrom.at/polytheism/pictures/TanzenderShiva.jpg

http://crazyleafdesign.com/blog/images/share/stumble.png

http://crazyleafdesign.com/blog/images/share/facebook.png

http://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be1

http://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2

http://folusho.com/wp-content/uploads/2010/09/web-20-what-is-300x251.jpg

http://psfk.com/img/icons/twitter.png

http://psfk.com/img/icons/facebook.png

http://healthylifenow.com/templates/7348/images/header_logo.jpg

http://healthylifenow.com/templates/7349/images/header_logo.jpg

http://hollandandbarrett.com/images/footer/account.jpg

http://hollandandbarrett.com/images/footer/account.gif

http://nationsautoelectric.com/images/50-217-1_F_1_.jpg

http://nationsautoelectric.com/images/50-217-1_F_2_.jpg

http://onlinebizdirectory.com/images/PowerShowBanner.gif

http://onlinebizdirectory.com/images/PowerHideBanner.gif

http://lostpropaganda.net/blog/pics/3321.jpg

http://lostpropaganda.net/blog/pics/3322.jpg

http://japanesegreenteaonline.com/assets/images/greentea-cha-1.gif

http://japanesegreenteaonline.com/assets/images/greentea-cha-2.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup250.gif

http://greenherbalteaonline.com/images/greenherbalteagirlholdingcup350.gif

http://onlineinstitute.com/g7/images/logo.jpg

http://onlineinstitute.com/g7/images/logo2.jpg

http://onlineinstitute.com/g7/images/logo3.jpg

http://onlineinstitute.com/g7/images/logo4.jpg

http://onlinedatingsecretfriends.com/images/im133.jpg

http://onlinedatingsecretfriends.com/images/im134.jpg

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 4 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/1600-17-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/4448-86-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/988-88-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral2/memory/4448-166-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1600-17-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4448-86-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/988-88-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral2/memory/4448-166-0x0000000000400000-0x000000000046B000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 1600	4448	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe	90
PID 4448 wrote to memory of 988	4448	jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Jorik.Gbot.ccc.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
  2⤵
  - System Location Discovery: System Language Discovery
  PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41BB.415

Path C:\Users\Admin\AppData\Roaming\41BB.415
Size 1KB
SHA256 7a0424a2095f01a48a54f794015fc454ba7ebf715f47a3725313dfbe73442cef
MD5 8c225d68d22f1f21bd26713dc0ecdd8d
SHA1 b2b6747d807651ee09ba26984b80635cddbd075a
SHA512 1c72796b5ecfd71b841bb3e80a273a02d35acf7dc41638b15af4a94a34d75da230ca05f0f1074cc28524981c1f59d379c737858a6bc39329a9dc00b85a63a03b
TLSH
T1C84126067F900AA7D90040BF02CF23207BD5F246B696A38BD2C029610CC176DEEE05F8
MD5 SHA1 SHA512 TLSH

Submit Download

41BB.415

Path C:\Users\Admin\AppData\Roaming\41BB.415
Size 897B
SHA256 66385a6524856793865f8b97f10a9510e8e8b20758afcbe71073f556457532da
MD5 aa480b789f6b4a57d8b577e09cc32c7a
SHA1 83145d72a353e6ef331d626586236425b4e23923
SHA512 bee39b05071eb0501cca00c3f74cefee3377b9cb1630a7ecc8e66ddbcdf32daa267ef0131615ddf0b85e40beb440494e8de22e064082ee28854cace8b7eadc10
TLSH
T1CC111204F6700F2BF050C9BD460B2317CB49E402B34133D396D43B426C10B7CE995170
MD5 SHA1 SHA512 TLSH

Submit Download

41BB.415

Path C:\Users\Admin\AppData\Roaming\41BB.415
Size 597B
SHA256 53bd150238d958a88aedddb42140cb3ad77e1263f8ab098152ac7a302006a9f7
MD5 cee305ac27b7df694c1191018a2dddc2
SHA1 43e84594cb6a2574f699e26fd16e38fdab0dbdd5
SHA512 db51bbf71357ce56e0cb015eb889fcc799f8af93a662ed8a5cb13e27a21dfdb6cc962c0810d47eaf82fe87e0cdba0795e09125969d6f5efc3cc3b108a680d0b9
TLSH
T1E2F00144F6344F2BE06585B98A1A271B8B8AE001A31123A786E83B45AC60A6CE9A6564
MD5 SHA1 SHA512 TLSH

Submit Download

41BB.415

Path C:\Users\Admin\AppData\Roaming\41BB.415
Size 1KB
SHA256 d2969bdedc744766a10eebafd7570670e4dfa4615801f05fd988bbbf4c62131c
MD5 8c75c066b8f37bf436b79e3094897b56
SHA1 6b4e0745a3933cc1c486d2c511e64f03270afecb
SHA512 263ea8ef29ee95d130e6ec4b124d552e5f5db15189109e9d06633d5a59b8bc0fb9e454ca3cf7c4347931961bbf3b219bb9f6753e21c566fe874aea85e42252c0
TLSH
T191212305BB900E57E400447B014B1311A795F6017201734751C026511CC072CDD941F4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-87-0x00000000006F0000-0x00000000007F0000-memory.dmp

Download

memory/988-88-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/1600-16-0x0000000000610000-0x0000000000710000-memory.dmp

Download

memory/1600-17-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/4448-1-0x0000000000550000-0x0000000000650000-memory.dmp

Download

memory/4448-18-0x0000000000550000-0x0000000000650000-memory.dmp

Download

memory/4448-86-0x0000000000400000-0x000000000046B000-memory.dmp

Download

memory/4448-166-0x0000000000400000-0x000000000046B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads