30 Days Of Cycbot

This report documents analysis of the Cycbot botnet (observed since March 10 and initially detected around August 2010), describing a characteristic HTTP beaconing pattern (?tq=BASE64 and optional vNUM1=NUM2) with a mozilla/2.0 user agent, decode attempts of embedded base64/XOR data, multiple MD5 sample hashes, and a broad, growing set of C2 domains and IPs — many recently registered or hosted on compromised sites. It highlights low AV detection on submissions and provides registrant/email artifacts and C2 listings to use as IOCs and patrol searches.