Overview

overview

10

Static

static

10

f3833850f0...18.exe

windows7-x64

1

f3833850f0...18.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3833850f0f2b4076d1fb02f50c4a509_JaffaCakes118

  • Size

    198KB

  • MD5

    f3833850f0f2b4076d1fb02f50c4a509

  • SHA1

    9fed05e907eb688e2ed00a2551fce89fdbfba8a2

  • SHA256

    8708b755c88c4d5a8bf8db88cc5da8002ce787e64e8107f4271e875ef07c27ac

  • SHA512

    f952736916898390205b26c8020d56e542b330ae6a2684bcf11af429c272d46250e9152450001ff3210ac8689aab0372cea03e0657a07a40426800727fce36b3

  • SSDEEP

    3072:lA7+tdM7cdsm5cFk1oOG5UP2s56S9NPEI+BclhIJihMjFuyoAdQYyBZeXqV1RHVH:2WFZZmkWJihMZfdMG0HV+q

Score
10/10
lib241trickbot

Malware Config

Extracted

Family

trickbot

Version

1000208

Botnet

lib241

C2

109.95.116.37:443

93.109.242.134:443

41.211.9.226:443

158.58.131.54:443

86.125.39.173:443

208.75.117.70:443

185.168.185.218:443

109.86.227.152:443

185.129.78.167:443

190.4.189.129:443

65.30.201.40:443

66.232.212.59:443

80.53.57.146:443

182.253.210.130:449

92.55.251.211:449

94.112.52.197:449

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Signatures

  • Trickbot family
    trickbot
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • f3833850f0f2b4076d1fb02f50c4a509_JaffaCakes118
    .exe windows:5 windows x64 arch:x64


    Headers

    Sections