Overview

overview

10

Static

static

3

5e9dd8cfc4...18.exe

windows7-x64

10

5e9dd8cfc4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e9dd8cfc460e06dc02066f8bc2e163f_JaffaCakes118

  • Size

    540KB

  • Sample

    240729-zdz3jstejd

  • MD5

    5e9dd8cfc460e06dc02066f8bc2e163f

  • SHA1

    d34e4b5712be208ae44620e8c354569cd56f65fa

  • SHA256

    89296bdba2b808ddfd578d47fa86bf2ca4899362aa7ca4aa2018fb86c236f041

  • SHA512

    518d14890ad8eb5b9d1ee77b24c5a98e5280676c8a8dca2a2167b8418483761f53688b4cb9ba7bafd436a4d6465b2cfbd8ac971e351a3a2b5b461ecbf587a9dc

  • SSDEEP

    12288:EssIG0GDuG1LSaSoBumwA6JqE5JfEn2FH:pmSCCJqE5JftH

Score
10/10
trickbotmor124bankerdiscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

1000514

Botnet

mor124

C2

51.89.163.40:443

89.223.126.186:443

45.67.231.68:443

148.251.185.165:443

194.87.110.144:443

213.32.84.27:443

185.234.72.35:443

45.89.125.148:443

195.123.240.104:443

185.99.2.243:443

5.182.211.223:443

195.123.240.113:443

85.204.116.173:443

5.152.210.188:443

103.36.48.103:449

36.94.33.102:449

36.91.87.227:449

177.190.69.162:449

103.76.169.213:449

179.97.246.23:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      5e9dd8cfc460e06dc02066f8bc2e163f_JaffaCakes118

    • Size

      540KB

    • MD5

      5e9dd8cfc460e06dc02066f8bc2e163f

    • SHA1

      d34e4b5712be208ae44620e8c354569cd56f65fa

    • SHA256

      89296bdba2b808ddfd578d47fa86bf2ca4899362aa7ca4aa2018fb86c236f041

    • SHA512

      518d14890ad8eb5b9d1ee77b24c5a98e5280676c8a8dca2a2167b8418483761f53688b4cb9ba7bafd436a4d6465b2cfbd8ac971e351a3a2b5b461ecbf587a9dc

    • SSDEEP

      12288:EssIG0GDuG1LSaSoBumwA6JqE5JfEn2FH:pmSCCJqE5JftH

    Score
    10/10
    trickbotmor124bankerdiscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks