Overview

overview

10

Static

static

3

JaffaCakes...d5.exe

windows7-x64

10

JaffaCakes...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a64a9881b5a4184f6b1579157ae3efd953a27c9ff0888d3c487b141abc4f65d5

  • Size

    996KB

  • Sample

    241221-zx1s7azmfn

  • MD5

    bea3aba5703981642155c0c919de75a1

  • SHA1

    b2af322f4fbd101e825c1f833d3be1b9a219ecfd

  • SHA256

    a64a9881b5a4184f6b1579157ae3efd953a27c9ff0888d3c487b141abc4f65d5

  • SHA512

    2f989082bd9edf1be47a11897d4f14ee4539b8b53a183ec7ff089a1f8fe89c07ee0bcff94102e89f28a8eda96e0e634176cc71ee90c1aa4cdeea084639536271

  • SSDEEP

    12288:tOYFN09JaCQWKfdWdOZMjD/mAOyQkNvOzxZNFIR77eMFHEk9xl6Z:twHQ11WdsR2OtZN+VeMFT9xl6Z

Score
10/10
trickbotlib787bankerdiscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

lib787

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      JaffaCakes118_a64a9881b5a4184f6b1579157ae3efd953a27c9ff0888d3c487b141abc4f65d5

    • Size

      996KB

    • MD5

      bea3aba5703981642155c0c919de75a1

    • SHA1

      b2af322f4fbd101e825c1f833d3be1b9a219ecfd

    • SHA256

      a64a9881b5a4184f6b1579157ae3efd953a27c9ff0888d3c487b141abc4f65d5

    • SHA512

      2f989082bd9edf1be47a11897d4f14ee4539b8b53a183ec7ff089a1f8fe89c07ee0bcff94102e89f28a8eda96e0e634176cc71ee90c1aa4cdeea084639536271

    • SSDEEP

      12288:tOYFN09JaCQWKfdWdOZMjD/mAOyQkNvOzxZNFIR77eMFHEk9xl6Z:twHQ11WdsR2OtZN+VeMFT9xl6Z

    Score
    10/10
    trickbotlib787bankerdiscoverytrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks