Overview

overview

10

Static

static

10

d80a0ea6a4...18.exe

windows7-x64

6

d80a0ea6a4...18.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d80a0ea6a4c17cf197675619efb21c5d_JaffaCakes118

  • Size

    172KB

  • MD5

    d80a0ea6a4c17cf197675619efb21c5d

  • SHA1

    28084949b4d30e88493bc66d052855f5569c5f26

  • SHA256

    e3f205dc6bef7380ba2aebfc043abc5150130c727b60ccb25ac0ca69d1206005

  • SHA512

    5e577c09216e04e3876bc8cbf708a9900c8e08f2599ca44a333665ac2cf0aa86b3b7afcf513b51f54c7362880fb77e46b3e0c13fc3eab763ebd04aeb4d9703de

  • SSDEEP

    3072:62tCWIN1W4ZCHqbiWjKlMJz8D0Aj5CxqhPRlTB9jIAfAQHeLCLfOcr7faxhqYgT0:62YrN1HN/jE4zW0AjwxqRR/9jIAIQSco

Score
10/10
del107trickbot

Malware Config

Extracted

Family

trickbot

Version

1000311

Botnet

del107

C2

82.202.212.172:443

24.247.181.155:449

24.247.182.39:449

109.234.38.220:443

24.247.182.29:449

24.247.182.7:449

71.14.129.8:449

198.46.131.164:443

74.132.135.120:449

198.46.160.217:443

71.94.101.25:443

206.130.141.255:449

192.3.52.107:443

74.140.160.33:449

65.31.241.133:449

140.190.54.187:449

24.247.181.226:449

108.160.196.130:449

23.94.187.116:443

103.110.91.118:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot family
    trickbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d80a0ea6a4c17cf197675619efb21c5d_JaffaCakes118
    .exe windows:5 windows x86 arch:x86

    25bf9a93cd1c021383748f90b0bc1193


    Headers

    Imports

    Sections