Overview

overview

10

Static

static

10

ab834dbd02...18.exe

windows7-x64

10

ab834dbd02...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab834dbd0203bdd3bf73de595323f05e_JaffaCakes118

  • Size

    108KB

  • Sample

    240614-z5rv9awepf

  • MD5

    ab834dbd0203bdd3bf73de595323f05e

  • SHA1

    bca08c9359733dd1c58aea63b2c76ab0b2fc922d

  • SHA256

    084cee6428487bf389fc95bb0e156af84023fb50e9377a08e0312d14fc45f060

  • SHA512

    9ef8a60ccced24fa25457d382b34e4a0c4750e8034f8988298d48cc00707a9d57a31bf14f9757b7fc52246e9175900b6c03f823e6b1f207369eaa9eb227b2aea

  • SSDEEP

    1536:Exwgk7ap0SDNqIf9wtxotBeK+iUB1PJniBtp56YWuqb6CdZ3Cq5dsmWlTGuBnW8J:Lgsan9wtitBeK+iAJiBVxWRHSqsx9

Score
10/10
trickbotjim579bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000474

Botnet

jim579

C2

51.68.247.62:443

37.228.117.146:443

91.132.139.170:443

37.44.212.216:443

31.184.253.37:443

51.254.69.244:443

194.5.250.82:443

5.230.22.40:443

185.222.202.222:443

46.30.41.229:443

203.23.128.168:443

190.154.203.218:449

189.80.134.122:449

200.116.199.10:449

181.113.20.186:449

187.58.56.26:449

146.196.122.167:449

177.103.240.149:449

181.199.102.179:449

200.21.51.38:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      ab834dbd0203bdd3bf73de595323f05e_JaffaCakes118

    • Size

      108KB

    • MD5

      ab834dbd0203bdd3bf73de595323f05e

    • SHA1

      bca08c9359733dd1c58aea63b2c76ab0b2fc922d

    • SHA256

      084cee6428487bf389fc95bb0e156af84023fb50e9377a08e0312d14fc45f060

    • SHA512

      9ef8a60ccced24fa25457d382b34e4a0c4750e8034f8988298d48cc00707a9d57a31bf14f9757b7fc52246e9175900b6c03f823e6b1f207369eaa9eb227b2aea

    • SSDEEP

      1536:Exwgk7ap0SDNqIf9wtxotBeK+iUB1PJniBtp56YWuqb6CdZ3Cq5dsmWlTGuBnW8J:Lgsan9wtitBeK+iAJiBVxWRHSqsx9

    Score
    10/10
    trickbotjim579bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks