cycbot | 8c6c5c1043b0d61b73eca7a652a3c3e1e641e9a878205764b59e939609d70e1b

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.e0467515805ef269d210ee69e26e3b58
Size 164KB
Sample261019-a7gevsxvey
SHA256 8c6c5c1043b0d61b73eca7a652a3c3e1e641e9a878205764b59e939609d70e1b
MD5 e0467515805ef269d210ee69e26e3b58
SHA1 7774a7797a6b782509fca4cb891384c53dbfc8e4
SHA512 dd3bf777a2790762054ae0a6d0d3ff94af26d08b9503faddbc2b20ef30f6d8c686d1f79efdefee846e7570972751835bb0dee259063404cccfbb0f5e073ac972
SSDEEP 3072:aDhVwDUDBPQ48+7X2pJmYSbBvjFN8EBuSXIJ7M77r4sWlC/bHBByCF683Z+d69:aVm4Px7GrUbhjFVBuSwe37W8y8pe
TLSH
T151F3F1E815B2BD31FB725A3369808238452C6B6FB8255FED33D6D1F1825F4258B492EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Targets

- Target
  jaffacakes118_HEUR.Trojan.Win32.Generic.e0467515805ef269d210ee69e26e3b58
- Size 164KB
- SHA256 8c6c5c1043b0d61b73eca7a652a3c3e1e641e9a878205764b59e939609d70e1b
- MD5 e0467515805ef269d210ee69e26e3b58
- SHA1 7774a7797a6b782509fca4cb891384c53dbfc8e4
- SHA512 dd3bf777a2790762054ae0a6d0d3ff94af26d08b9503faddbc2b20ef30f6d8c686d1f79efdefee846e7570972751835bb0dee259063404cccfbb0f5e073ac972
- SSDEEP 3072:aDhVwDUDBPQ48+7X2pJmYSbBvjFN8EBuSXIJ7M77r4sWlC/bHBByCF683Z+d69:aVm4Px7GrUbhjFVBuSwe37W8y8pe
- TLSH
  T151F3F1E815B2BD31FB725A3369808238452C6B6FB8255FED33D6D1F1825F4258B492EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx
- Detects Cycbot payload
  Cycbot is a backdoor and trojan written in C++.
- Family: Cycbot
  Cycbot is a backdoor and trojan written in C++..
  backdoor rat cycbot
- Modifies WinLogon for persistence
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2