Overview

overview

10

Static

static

3

26aca67e75...18.exe

windows7-x64

10

26aca67e75...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26aca67e755b79679663436a4996ddbf_JaffaCakes118

  • Size

    678KB

  • Sample

    240728-1yl7vsxdkq

  • MD5

    26aca67e755b79679663436a4996ddbf

  • SHA1

    92aaef7ce303ad5aeeb09c0acd38be75affc6f2d

  • SHA256

    faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350

  • SHA512

    bd98a1712a883632374b028eaf0a615709319571effdf569249f483c1fe0ff86f14370026f18ea9e42fbf2aa772a27da8ba318d7919dff2dd282be300d401ebc

  • SSDEEP

    12288:uqluOGXcc5O95gTHGJGxc/Mi1qF6gnc4DYTP3EEyB7u/adsNDQmTHzRXy2EGkGux:uOu1CwamU+svEEs5sNDpTRXPhA

Score
10/10
trickbotmor125bankerdavediscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

1000514

Botnet

mor125

C2

51.89.163.40:443

89.223.126.186:443

45.67.231.68:443

148.251.185.165:443

194.87.110.144:443

213.32.84.27:443

185.234.72.35:443

45.89.125.148:443

195.123.240.104:443

185.99.2.243:443

5.182.211.223:443

195.123.240.113:443

85.204.116.173:443

5.152.210.188:443

103.36.48.103:449

36.94.33.102:449

36.91.87.227:449

177.190.69.162:449

103.76.169.213:449

179.97.246.23:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      26aca67e755b79679663436a4996ddbf_JaffaCakes118

    • Size

      678KB

    • MD5

      26aca67e755b79679663436a4996ddbf

    • SHA1

      92aaef7ce303ad5aeeb09c0acd38be75affc6f2d

    • SHA256

      faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350

    • SHA512

      bd98a1712a883632374b028eaf0a615709319571effdf569249f483c1fe0ff86f14370026f18ea9e42fbf2aa772a27da8ba318d7919dff2dd282be300d401ebc

    • SSDEEP

      12288:uqluOGXcc5O95gTHGJGxc/Mi1qF6gnc4DYTP3EEyB7u/adsNDQmTHzRXy2EGkGux:uOu1CwamU+svEEs5sNDpTRXPhA

    Score
    10/10
    trickbotmor125bankerdavediscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks