General
-
Target
0737d85cfb1e2d4a2d13dd35a447e0b4_JaffaCakes118
-
Size
912KB
-
Sample
240624-jewhra1crb
-
MD5
0737d85cfb1e2d4a2d13dd35a447e0b4
-
SHA1
a3493c1751a5457a6fb39af77ce474c2e2da6841
-
SHA256
0c62485c024777634c7fa33d094f3fe1c189d918ede9904aa07d8f243d2f5371
-
SHA512
9469b5df3bc38cbe55a84c7211157e87be55af0782255ded0f1bb058cc7e5fe60bcde39ea1358b4abb89020fb5ff77e8d6ba3c3b00ef60f6f2f70cf004d4631b
-
SSDEEP
12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclw48v1jBq9kKj7Nivzqg:2JkRBALfWye2er556HFBqnj7G+g
Malware Config
Extracted
trickbot
2000025
tot39
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
-
autorunName:pwgrab
Targets
-
-
Target
0737d85cfb1e2d4a2d13dd35a447e0b4_JaffaCakes118
-
Size
912KB
-
MD5
0737d85cfb1e2d4a2d13dd35a447e0b4
-
SHA1
a3493c1751a5457a6fb39af77ce474c2e2da6841
-
SHA256
0c62485c024777634c7fa33d094f3fe1c189d918ede9904aa07d8f243d2f5371
-
SHA512
9469b5df3bc38cbe55a84c7211157e87be55af0782255ded0f1bb058cc7e5fe60bcde39ea1358b4abb89020fb5ff77e8d6ba3c3b00ef60f6f2f70cf004d4631b
-
SSDEEP
12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclw48v1jBq9kKj7Nivzqg:2JkRBALfWye2er556HFBqnj7G+g
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Executes dropped EXE
-
Loads dropped DLL
-