Overview

overview

10

Static

static

3

8b141f0342...18.dll

windows7-x64

10

8b141f0342...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118

  • Size

    451KB

  • Sample

    240811-tvlcts1gnf

  • MD5

    8b141f034205fae56a4bc7e82b830cfc

  • SHA1

    0e4fe98c6c0d20941a59e62b1109c033c639f715

  • SHA256

    d7e3760fcc1324aef1d78035e02566fe575a29fcd0dbe7287a37459a42ffcdbd

  • SHA512

    e206c3e4c600376bfa073674b4818808883d022f352e27b0cbd52abe1b332b50e9d15612b418a9b07e74a4ec01c7c9ea93d59238aab66cb569a5cb63504ca388

  • SSDEEP

    12288:ofO5ZXvRjuyj6GaJTOoiN6WxSC5L/+UzEO:F/XxuZ2dxP3YO

Score
10/10
trickbotmon54bankerdiscoverypackertrojan

Malware Config

Extracted

Family

trickbot

Version

100011

Botnet

mon54

C2

194.5.249.156:443

142.202.191.164:443

193.8.194.96:443

45.155.173.242:443

108.170.20.75:443

185.163.45.138:443

94.140.114.136:443

134.119.186.202:443

200.52.147.93:443

45.230.244.20:443

186.250.157.116:443

186.137.85.76:443

36.94.62.207:443

182.253.107.34:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      8b141f034205fae56a4bc7e82b830cfc_JaffaCakes118

    • Size

      451KB

    • MD5

      8b141f034205fae56a4bc7e82b830cfc

    • SHA1

      0e4fe98c6c0d20941a59e62b1109c033c639f715

    • SHA256

      d7e3760fcc1324aef1d78035e02566fe575a29fcd0dbe7287a37459a42ffcdbd

    • SHA512

      e206c3e4c600376bfa073674b4818808883d022f352e27b0cbd52abe1b332b50e9d15612b418a9b07e74a4ec01c7c9ea93d59238aab66cb569a5cb63504ca388

    • SSDEEP

      12288:ofO5ZXvRjuyj6GaJTOoiN6WxSC5L/+UzEO:F/XxuZ2dxP3YO

    Score
    10/10
    trickbotbankerdiscoverytrojanmon54packer

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

      packer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks