Overview

overview

10

Static

static

3

cf63b9cc01...18.exe

windows7-x64

10

cf63b9cc01...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cf63b9cc0187cd8344b71464c0172ab8_JaffaCakes118

  • Size

    296KB

  • Sample

    240906-m117xashma

  • MD5

    cf63b9cc0187cd8344b71464c0172ab8

  • SHA1

    c91688c5c546720c26e7d0b72ecf6ecc42669bbf

  • SHA256

    7974d6324dbba7811d9a59dd5784751536a35689a50609e2739ba3370c70aa43

  • SHA512

    41fa3692ef4268121ae04b73c18a77bbfdf264aca50767b22d635e99718ca239fed7a574185894632bb72b5ec50d668699fea38016e67def5a06e1840d05bd5d

  • SSDEEP

    6144:BBhyasViILrAy8rmpWDTNMHZn66EjAKR1jVqAqKx4+6As6ZhM76f+A:BLWyUh6VAKRVEvKadAs6QaZ

Score
10/10
trickbotmor127bankerdavediscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

2000010

Botnet

mor127

C2

195.123.239.59:443

85.143.219.36:443

94.250.254.84:443

94.250.255.217:443

212.80.219.98:443

91.210.171.82:443

45.8.230.108:443

194.156.98.172:443

195.2.93.227:443

62.108.35.179:443

91.200.101.192:443

194.5.249.31:443

195.123.241.157:443

104.161.32.10:443

88.150.197.186:443

62.108.35.204:443

45.155.173.196:443

51.89.177.18:443

194.5.249.107:443

195.123.241.182:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      cf63b9cc0187cd8344b71464c0172ab8_JaffaCakes118

    • Size

      296KB

    • MD5

      cf63b9cc0187cd8344b71464c0172ab8

    • SHA1

      c91688c5c546720c26e7d0b72ecf6ecc42669bbf

    • SHA256

      7974d6324dbba7811d9a59dd5784751536a35689a50609e2739ba3370c70aa43

    • SHA512

      41fa3692ef4268121ae04b73c18a77bbfdf264aca50767b22d635e99718ca239fed7a574185894632bb72b5ec50d668699fea38016e67def5a06e1840d05bd5d

    • SSDEEP

      6144:BBhyasViILrAy8rmpWDTNMHZn66EjAKR1jVqAqKx4+6As6ZhM76f+A:BLWyUh6VAKRVEvKadAs6QaZ

    Score
    10/10
    trickbotmor127bankerdavediscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks