Overview

overview

10

Static

static

3

ec2193e0b1...18.exe

windows7-x64

10

ec2193e0b1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec2193e0b1f7d9cd55791f15dcab3594_JaffaCakes118

  • Size

    416KB

  • Sample

    241213-sqqw3ssmht

  • MD5

    ec2193e0b1f7d9cd55791f15dcab3594

  • SHA1

    5f4f7f432828491c79bd05b73f6390758b8ca4f4

  • SHA256

    db3548188e4bd87806b34a7f13098429ac8b9ad4c700879cb198cbcffa835d0c

  • SHA512

    8ee46c77be0bc2a4559cf31a7c6471e20d976b8793f2f99590a854a5cf94c6732935a962a32a2f4b0fd6dd0d4b035a8124b9b5c7f06376b7a38cc8d7ee2b84a6

  • SSDEEP

    6144:R2G15aDfcPENBatRyCUF+P5ZGvWR8hq5tkDcFHm393/afc:ycPENuP5OQ84zwcFoCf

Score
10/10
trickbottt0002bankerdiscoveryevasionpersistencetrojan

Malware Config

Extracted

Family

trickbot

Version

1000195

Botnet

tt0002

C2

208.75.117.70:449

92.55.251.211:449

118.91.178.139:449

94.112.52.197:449

176.100.210.25:449

138.34.29.172:443

209.121.142.202:449

5.102.177.205:449

209.121.142.214:449

95.161.180.42:449

203.86.222.142:443

46.20.207.204:443

68.96.73.154:449

185.42.192.194:449

68.227.31.46:449

107.144.49.162:443

46.72.175.17:449

144.48.51.8:443

46.243.179.212:449

81.177.255.76:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target

      ec2193e0b1f7d9cd55791f15dcab3594_JaffaCakes118

    • Size

      416KB

    • MD5

      ec2193e0b1f7d9cd55791f15dcab3594

    • SHA1

      5f4f7f432828491c79bd05b73f6390758b8ca4f4

    • SHA256

      db3548188e4bd87806b34a7f13098429ac8b9ad4c700879cb198cbcffa835d0c

    • SHA512

      8ee46c77be0bc2a4559cf31a7c6471e20d976b8793f2f99590a854a5cf94c6732935a962a32a2f4b0fd6dd0d4b035a8124b9b5c7f06376b7a38cc8d7ee2b84a6

    • SSDEEP

      6144:R2G15aDfcPENBatRyCUF+P5ZGvWR8hq5tkDcFHm393/afc:ycPENuP5OQ84zwcFoCf

    Score
    10/10
    trickbottt0002bankerdiscoveryevasiontrojanpersistence

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks