Overview

overview

10

Static

static

3

cb773cb211...18.exe

windows7-x64

10

cb773cb211...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb773cb211f29f47bb38e41e808ff224_JaffaCakes118

  • Size

    416KB

  • Sample

    240830-xny7wszdpc

  • MD5

    cb773cb211f29f47bb38e41e808ff224

  • SHA1

    d2f3890916ce4a93b2aef7bacd60efd9e3f7e096

  • SHA256

    2c8b0ccf5a48d1d2ec178d35c7fe681bd490e50e5958bb8f4ac484ca0dd7d8d4

  • SHA512

    6d5f9e455a882b315f92bdb6e2abbff5f9a4df05a62d1aa5c07728e360712c77ae185ab461d116912e9473c8aa5c9cdf41172e4eaa5adeeaef5fd8f4557a1bde

  • SSDEEP

    6144:fytXj0COCPRNw5OySm7OaEPDwQGybvkq/qDYT6UGUNQGr5:fy5V9c56laWJt/qDYTbXNQGr

Score
10/10
trickbottt0002bankerdiscoveryevasionpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000195

Botnet

tt0002

C2

208.75.117.70:449

92.55.251.211:449

118.91.178.139:449

94.112.52.197:449

176.100.210.25:449

138.34.29.172:443

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

46.20.207.204:443

68.96.73.154:449

185.42.192.194:449

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      cb773cb211f29f47bb38e41e808ff224_JaffaCakes118

    • Size

      416KB

    • MD5

      cb773cb211f29f47bb38e41e808ff224

    • SHA1

      d2f3890916ce4a93b2aef7bacd60efd9e3f7e096

    • SHA256

      2c8b0ccf5a48d1d2ec178d35c7fe681bd490e50e5958bb8f4ac484ca0dd7d8d4

    • SHA512

      6d5f9e455a882b315f92bdb6e2abbff5f9a4df05a62d1aa5c07728e360712c77ae185ab461d116912e9473c8aa5c9cdf41172e4eaa5adeeaef5fd8f4557a1bde

    • SSDEEP

      6144:fytXj0COCPRNw5OySm7OaEPDwQGybvkq/qDYT6UGUNQGr5:fy5V9c56laWJt/qDYTbXNQGr

    Score
    10/10
    trickbottt0002bankerdiscoveryevasiontrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks