Overview

overview

10

Static

static

3

b424415116...18.dll

windows7-x64

10

b424415116...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4244151165b14bf5df91cd9046aafad_JaffaCakes118

  • Size

    429KB

  • Sample

    240821-tn781syblf

  • MD5

    b4244151165b14bf5df91cd9046aafad

  • SHA1

    34fa5848b052603e350bb64a9cc015197d32d068

  • SHA256

    d935c653803a8efd039fad751bd98d8bd0ac36259640cbe7bedaed9c1663bc90

  • SHA512

    fa55333caf4ebd767b7196d753cbe357267b3db7dee4d527ccf7905d2873e59e52e57fd6b53aa613d28f520722dcbc90d57ae5ced80b17767741ebc4ddb88cb4

  • SSDEEP

    12288:3wyC9lqNkv0cRZvLRQebhp80jWLjFa9e2J:+dNtFlO02jU9L

Score
10/10
trickbotmon43bankerdiscoverypackertrojan

Malware Config

Extracted

Family

trickbot

Version

100011

Botnet

mon43

C2

194.5.249.156:443

142.202.191.164:443

193.8.194.96:443

45.155.173.242:443

108.170.20.75:443

185.163.45.138:443

94.140.114.136:443

134.119.186.202:443

200.52.147.93:443

45.230.244.20:443

186.250.157.116:443

186.137.85.76:443

36.94.62.207:443

182.253.107.34:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      b4244151165b14bf5df91cd9046aafad_JaffaCakes118

    • Size

      429KB

    • MD5

      b4244151165b14bf5df91cd9046aafad

    • SHA1

      34fa5848b052603e350bb64a9cc015197d32d068

    • SHA256

      d935c653803a8efd039fad751bd98d8bd0ac36259640cbe7bedaed9c1663bc90

    • SHA512

      fa55333caf4ebd767b7196d753cbe357267b3db7dee4d527ccf7905d2873e59e52e57fd6b53aa613d28f520722dcbc90d57ae5ced80b17767741ebc4ddb88cb4

    • SSDEEP

      12288:3wyC9lqNkv0cRZvLRQebhp80jWLjFa9e2J:+dNtFlO02jU9L

    Score
    10/10
    trickbotmon43bankerdiscoverypackertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

      packer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks