General
-
Target
faa4ace74dffe3fc0e2be6cee5013090_JaffaCakes118
-
Size
391KB
-
Sample
241218-jdfqxa1kej
-
MD5
faa4ace74dffe3fc0e2be6cee5013090
-
SHA1
245ff27a43addec666e4e212c9fadd523ee56ead
-
SHA256
2dbfd02a15887171a5d5bf5f32a9afceb9e8b50d9f6a51bf243a61a43b2d660c
-
SHA512
c3b81475c807649de35d55e66772d2c0daec15d365584a56e4a09aa9382df280d2ae8c492fcf72a752ae7fede8bec870e78497243b117c654a6b30ebe02c4ae1
-
SSDEEP
6144:fhXzmDBd2N0JtzYZ2fQwOIi+IVASt22i3A9g+Q6f:pjEtmqQcxIVAuOm
Static task
static1
Behavioral task
behavioral1
Sample
faa4ace74dffe3fc0e2be6cee5013090_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
trickbot
1000192
tt0002
209.121.142.202:449
5.102.177.205:449
209.121.142.214:449
95.161.180.42:449
203.86.222.142:449
109.95.114.28:449
118.91.178.106:449
173.220.6.194:449
179.107.89.145:449
46.20.207.204:449
91.206.4.216:449
69.122.117.95:449
68.96.73.154:449
185.42.192.194:449
189.84.125.37:449
68.227.31.46:449
107.144.49.162:449
46.72.175.17:449
144.48.51.8:449
46.243.179.212:449
191.6.18.166:449
81.177.255.76:449
94.250.251.49:443
80.93.182.51:443
37.230.116.77:443
185.174.172.20:443
82.146.57.73:443
82.146.62.210:443
37.230.112.67:443
80.87.197.152:443
37.230.116.56:443
91.235.129.15:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Targets
-
-
Target
faa4ace74dffe3fc0e2be6cee5013090_JaffaCakes118
-
Size
391KB
-
MD5
faa4ace74dffe3fc0e2be6cee5013090
-
SHA1
245ff27a43addec666e4e212c9fadd523ee56ead
-
SHA256
2dbfd02a15887171a5d5bf5f32a9afceb9e8b50d9f6a51bf243a61a43b2d660c
-
SHA512
c3b81475c807649de35d55e66772d2c0daec15d365584a56e4a09aa9382df280d2ae8c492fcf72a752ae7fede8bec870e78497243b117c654a6b30ebe02c4ae1
-
SSDEEP
6144:fhXzmDBd2N0JtzYZ2fQwOIi+IVASt22i3A9g+Q6f:pjEtmqQcxIVAuOm
-
Trickbot family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-