cycbot | 8c6c5c1043b0d61b73eca7a652a3c3e1e641e9a878205764b59e939609d70e1b

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 164KB
Sample261019-a7gevsxvey
SHA256 8c6c5c1043b0d61b73eca7a652a3c3e1e641e9a878205764b59e939609d70e1b
MD5 e0467515805ef269d210ee69e26e3b58
SHA1 7774a7797a6b782509fca4cb891384c53dbfc8e4
SHA512 dd3bf777a2790762054ae0a6d0d3ff94af26d08b9503faddbc2b20ef30f6d8c686d1f79efdefee846e7570972751835bb0dee259063404cccfbb0f5e073ac972
SSDEEP 3072:aDhVwDUDBPQ48+7X2pJmYSbBvjFN8EBuSXIJ7M77r4sWlC/bHBByCF683Z+d69:aVm4Px7GrUbhjFVBuSwe37W8y8pe
TLSH
T151F3F1E815B2BD31FB725A3369808238452C6B6FB8255FED33D6D1F1825F4258B492EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware backdoor discovery cycbot persistence rat spyware upx

Malware Config

Extracted

Family

cycbot

Attributes

payload_url
http://binghamtonschools.org/images/ace/1/ace_1101278014_1314729789.jpg

http://binghamtonschools.org/images/297893.jpg

http://binghamtonschools.org/images/297894.jpg

http://alleducationalsoftware.com/creditcardlogos.gif

http://alleducationalsoftware.com/creditcard.png

http://alleducationalsoftware.com/creditcard2.png

http://patentgenius.com/temp/head.png

http://patentgenius.com/132.gif

http://patentgenius.com/133.gif

http://freedownload3.com/screenshot/4/s/89_3276.gif

http://freedownload3.com/screenshot/4/s/89_3277.gif

http://freedownload3.com/screenshot/4/s/89_3278.gif

http://istockanalyst.com/png/intel.gif

http://istockanalyst.com/png/intel.jpg

http://istockanalyst.com/12.jpg

http://complaintsboard.com/complaints/logo.png

http://complaintsboard.com/complaints/zip.png

http://complaintsboard.com/complaints/rar.png

http://highspeedinternetlosangeles.webnode.com/news/1.cgi

http://highspeedinternetlosangeles.webnode.com/news/1.php

http://highspeedinternetlosangeles.webnode.com/news/2.php

http://newworldorderreport.com/favicon.ico

http://newworldorderreport.com/img/3421.png

http://newworldorderreport.com/img/3422.png

http://jointhenewworldorder.com/images/pages.jpg

http://jointhenewworldorder.com/images/pages.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame6.png

http://cdn.adventofdeception.com/wp-content/uploads/2011/06/frame7.png

http://cdn.adventofdeception.com/logo.png

http://%s/s.php?c=121&id=%s

http://xprstats.com/images/logo.png

Signatures

Family: Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot

Detects Cycbot payload 5 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral2/memory/2560-13-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/3236-14-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/1200-138-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/3236-139-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot
behavioral2/memory/3236-300-0x0000000000400000-0x0000000000491000-memory.dmp	family_cycbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\35F39\\4DA67.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2560-13-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3236-14-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/1200-138-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3236-139-0x0000000000400000-0x0000000000491000-memory.dmp	upx
behavioral2/memory/3236-300-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1400	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1400	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1400	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1400	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 2560	3236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 3236 wrote to memory of 1200	3236	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Modifies WinLogon for persistence
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\LP\6753\A71.exe%C:\Program Files (x86)\LP\6753
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe startC:\Program Files (x86)\3932A\lvvm.exe%C:\Program Files (x86)\3932A
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1200

C:\Windows\explorer.exe
explorer.exe ,C:\Users\Admin\AppData\Roaming\35F39\4DA67.exe
1⤵
PID:2500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

932A.5F3

Path C:\Users\Admin\AppData\Roaming\35F39\932A.5F3
Size 996B
SHA256 de029eda45b6e6f45001b7ecee8b83177c102e52747201f2705510679881298b
MD5 e135d9b2a8ad50d505b8cd4555355dcf
SHA1 4347c8d6901ac982f1f2b3baf09715c65e1804fa
SHA512 b571d480314ebf197765211430b4d736de8b43e3836d1a25afd5e4e15a81e5e446080cdd018b08e17f554312abc34c734d56544295acd09ebdc3404d64e75ea7
TLSH
T1F71180175FD11519C1154573024B23513799EB0561419787845116941CC2724C81958C
MD5 SHA1 SHA512 TLSH

Submit Download

932A.5F3

Path C:\Users\Admin\AppData\Roaming\35F39\932A.5F3
Size 600B
SHA256 ef93a4778d21913841e97d31cfded6d6747059eea6c8a3215c1e9e53eb704a8c
MD5 6dcd7c2529967c9a25448a1a9e5d96a9
SHA1 d7a00bed185a93b01b1db217e85086d3c98ce3c1
SHA512 dbc9a84bfd15912fde60fb245023cce0a5bc1d820c9f13a1dc5cd8deea431e71a98cb7092b0f25b442b2a4dd08e81a8fb9cb22bb176aa5e4741bf602797d86ca
TLSH
T102F02223C2800223C0A00EF2000B0323A308B800B20023CACC202EE02C00E3CC00C80C
MD5 SHA1 SHA512 TLSH

Submit Download

932A.5F3

Path C:\Users\Admin\AppData\Roaming\35F39\932A.5F3
Size 1KB
SHA256 c80250ed12704b9992857aba139152f40c064b46ce7a3624cacaf3adeabf4f6f
MD5 8c2dff4b83ed167f5067f57a5461ad46
SHA1 35f42b235f7892e60c6c5d7bbb7fef29e7eeb40f
SHA512 cf6cbb8b6bbcc6f6712e27a18bbf8a41b98d289868e12bd2583f5dc6a4b3d643602fb1ded47fae07405ffdb1fa7028a5b8535d33ae1dced5ec730d852a8f0297
TLSH
T1BC31CD171FD13429C115A173034E3351779BEB0551D1EF47D55115681DD3715CC699C8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1200-138-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/1400-136-0x0000000003760000-0x00000000037C2000-memory.dmp

Download

memory/2560-13-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/3236-0-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/3236-2-0x0000000000540000-0x0000000000640000-memory.dmp

Download

memory/3236-14-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/3236-15-0x0000000000540000-0x0000000000640000-memory.dmp

Download

memory/3236-139-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/3236-300-0x0000000000400000-0x0000000000491000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads