Overview

overview

10

Static

static

10

d80a0ea6a4...18.exe

windows7-x64

6

d80a0ea6a4...18.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d80a0ea6a4c17cf197675619efb21c5d_JaffaCakes118

  • Size

    172KB

  • Sample

    240910-l3ydcsyajj

  • MD5

    d80a0ea6a4c17cf197675619efb21c5d

  • SHA1

    28084949b4d30e88493bc66d052855f5569c5f26

  • SHA256

    e3f205dc6bef7380ba2aebfc043abc5150130c727b60ccb25ac0ca69d1206005

  • SHA512

    5e577c09216e04e3876bc8cbf708a9900c8e08f2599ca44a333665ac2cf0aa86b3b7afcf513b51f54c7362880fb77e46b3e0c13fc3eab763ebd04aeb4d9703de

  • SSDEEP

    3072:62tCWIN1W4ZCHqbiWjKlMJz8D0Aj5CxqhPRlTB9jIAfAQHeLCLfOcr7faxhqYgT0:62YrN1HN/jE4zW0AjwxqRR/9jIAIQSco

Score
10/10
trickbotdel107discovery

Malware Config

Extracted

Family

trickbot

Version

1000311

Botnet

del107

C2

82.202.212.172:443

24.247.181.155:449

24.247.182.39:449

109.234.38.220:443

24.247.182.29:449

24.247.182.7:449

71.14.129.8:449

198.46.131.164:443

74.132.135.120:449

198.46.160.217:443

71.94.101.25:443

206.130.141.255:449

192.3.52.107:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

108.160.196.130:449

23.94.187.116:443

103.110.91.118:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      d80a0ea6a4c17cf197675619efb21c5d_JaffaCakes118

    • Size

      172KB

    • MD5

      d80a0ea6a4c17cf197675619efb21c5d

    • SHA1

      28084949b4d30e88493bc66d052855f5569c5f26

    • SHA256

      e3f205dc6bef7380ba2aebfc043abc5150130c727b60ccb25ac0ca69d1206005

    • SHA512

      5e577c09216e04e3876bc8cbf708a9900c8e08f2599ca44a333665ac2cf0aa86b3b7afcf513b51f54c7362880fb77e46b3e0c13fc3eab763ebd04aeb4d9703de

    • SSDEEP

      3072:62tCWIN1W4ZCHqbiWjKlMJz8D0Aj5CxqhPRlTB9jIAfAQHeLCLfOcr7faxhqYgT0:62YrN1HN/jE4zW0AjwxqRR/9jIAIQSco

    Score
    6/10
    discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks