Overview

overview

10

Static

static

10

ab834dbd02...18.exe

windows7-x64

10

ab834dbd02...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab834dbd0203bdd3bf73de595323f05e_JaffaCakes118

  • Size

    108KB

  • MD5

    ab834dbd0203bdd3bf73de595323f05e

  • SHA1

    bca08c9359733dd1c58aea63b2c76ab0b2fc922d

  • SHA256

    084cee6428487bf389fc95bb0e156af84023fb50e9377a08e0312d14fc45f060

  • SHA512

    9ef8a60ccced24fa25457d382b34e4a0c4750e8034f8988298d48cc00707a9d57a31bf14f9757b7fc52246e9175900b6c03f823e6b1f207369eaa9eb227b2aea

  • SSDEEP

    1536:Exwgk7ap0SDNqIf9wtxotBeK+iUB1PJniBtp56YWuqb6CdZ3Cq5dsmWlTGuBnW8J:Lgsan9wtitBeK+iAJiBVxWRHSqsx9

Score
10/10
jim579trickbot

Malware Config

Extracted

Family

trickbot

Version

1000474

Botnet

jim579

C2

51.68.247.62:443

37.228.117.146:443

91.132.139.170:443

37.44.212.216:443

31.184.253.37:443

51.254.69.244:443

194.5.250.82:443

5.230.22.40:443

185.222.202.222:443

46.30.41.229:443

203.23.128.168:443

190.154.203.218:449

189.80.134.122:449

200.116.199.10:449

181.113.20.186:449

187.58.56.26:449

146.196.122.167:449

177.103.240.149:449

181.199.102.179:449

200.21.51.38:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot family
    trickbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ab834dbd0203bdd3bf73de595323f05e_JaffaCakes118
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections