Overview

overview

10

Static

static

3

JaffaCakes...cf.exe

windows7-x64

10

JaffaCakes...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_e3a8d7e8cda02243bb9c186cb741216c18d845683a6cdca2117866c7f103e6cf

  • Size

    897KB

  • Sample

    241222-e42c3stlgy

  • MD5

    73fcd0d25a449025c36cb0a7b41ac194

  • SHA1

    7fdbdef1d22ca82a4a32ac3ca9ff1540fafd0e0c

  • SHA256

    e3a8d7e8cda02243bb9c186cb741216c18d845683a6cdca2117866c7f103e6cf

  • SHA512

    cb6870e481b3567c53d7f6a09d88bac0a2c51ab572ac77cd6552545c3335ecaaff856aa4cbc45bd8f7c1dcf4ff72f0a7dafc679e3554816ecead02a1025333b8

  • SSDEEP

    12288:xoI9bkG8Si/EB3hUgGL0o6ImasLOlMS9mfzID6nwg575IYh1gXPwbnfh4N1N1yXW:xp9bkGq8BOhIc9kcOwg575P1BnyK0UO

Score
10/10
trickbotrob35bankerdiscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob35

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      JaffaCakes118_e3a8d7e8cda02243bb9c186cb741216c18d845683a6cdca2117866c7f103e6cf

    • Size

      897KB

    • MD5

      73fcd0d25a449025c36cb0a7b41ac194

    • SHA1

      7fdbdef1d22ca82a4a32ac3ca9ff1540fafd0e0c

    • SHA256

      e3a8d7e8cda02243bb9c186cb741216c18d845683a6cdca2117866c7f103e6cf

    • SHA512

      cb6870e481b3567c53d7f6a09d88bac0a2c51ab572ac77cd6552545c3335ecaaff856aa4cbc45bd8f7c1dcf4ff72f0a7dafc679e3554816ecead02a1025333b8

    • SSDEEP

      12288:xoI9bkG8Si/EB3hUgGL0o6ImasLOlMS9mfzID6nwg575IYh1gXPwbnfh4N1N1yXW:xp9bkGq8BOhIc9kcOwg575P1BnyK0UO

    Score
    10/10
    trickbotrob35bankerdiscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Blocklisted process makes network request

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks