trickbot

General

Target

8291cbc6873e8019b6c0cb4472393d0f_JaffaCakes118
Size

589KB
Sample

240802-b52hpayblm
MD5

8291cbc6873e8019b6c0cb4472393d0f
SHA1

dcfcfd02bd709280e55ae8356ffa2f7744092e28
SHA256

e1c3eeb926cb6b2652dab8077a2ffcca6da1005423debe16e5ca1a4e1b5b5858
SHA512

c650cd9b2bca6003f9c5ef1904c828f926e43024ddcd31cc8a6cdaaee6fcf28847ed9bee1fcf0640471e8515180e71c19c6cb14220cbd5b446d7e16bcdc0085c
SSDEEP

12288:Ua35NNMyw08jsI525olVNyM+ptFzTphtaMww0PXMUiMM8:Ug5NNhw0UT525oLN6pt1Tph0Rv

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

100011

Botnet

mon65

C2

194.5.249.156:443

142.202.191.164:443

193.8.194.96:443

45.155.173.242:443

108.170.20.75:443

185.163.45.138:443

94.140.114.136:443

134.119.186.202:443

200.52.147.93:443

45.230.244.20:443

186.250.157.116:443

186.137.85.76:443

36.94.62.207:443

182.253.107.34:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  8291cbc6873e8019b6c0cb4472393d0f_JaffaCakes118
- Size
  
  589KB
- MD5
  
  8291cbc6873e8019b6c0cb4472393d0f
- SHA1
  
  dcfcfd02bd709280e55ae8356ffa2f7744092e28
- SHA256
  
  e1c3eeb926cb6b2652dab8077a2ffcca6da1005423debe16e5ca1a4e1b5b5858
- SHA512
  
  c650cd9b2bca6003f9c5ef1904c828f926e43024ddcd31cc8a6cdaaee6fcf28847ed9bee1fcf0640471e8515180e71c19c6cb14220cbd5b446d7e16bcdc0085c
- SSDEEP
  
  12288:Ua35NNMyw08jsI525olVNyM+ptFzTphtaMww0PXMUiMM8:Ug5NNhw0UT525oLN6pt1Tph0Rv
Score

10^/10

trickbot mon65 banker discovery packer trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Templ.dll packer
  Detects Templ.dll packer which usually loads Trickbot.
  packer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Templ.dll packer

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2