Overview

overview

10

Static

static

3

7974d6324d...43.exe

windows7-x64

10

7974d6324d...43.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_75b4078aa10d136a28d55902fb337f28024f4a1b4537d2548f03d878d191bbfe

  • Size

    265KB

  • Sample

    241222-gld6yawqfk

  • MD5

    7f24c4941b7658fe09e21ae12c4a3e12

  • SHA1

    71ae4d0964e75df7e8da23712fca0895d5371548

  • SHA256

    75b4078aa10d136a28d55902fb337f28024f4a1b4537d2548f03d878d191bbfe

  • SHA512

    8c6ab4cd504a0e94650309a65504ca72ef6588d8294594431b31a72ff406706ab57bdf17df4fa63c507222c802e5728c278285d239895c8cf69ef03f8da74f07

  • SSDEEP

    6144:sOXyLfbOQat9X0Nwc4vP6THbrX5LsL/tr39JzSRuQpXXqvr3Gh7xlw:tXyzbDy0NEu3X5OCqTWNw

Score
10/10
trickbotmor127bankerdavediscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

2000010

Botnet

mor127

C2

195.123.239.59:443

85.143.219.36:443

94.250.254.84:443

94.250.255.217:443

212.80.219.98:443

91.210.171.82:443

45.8.230.108:443

194.156.98.172:443

195.2.93.227:443

62.108.35.179:443

91.200.101.192:443

194.5.249.31:443

195.123.241.157:443

104.161.32.10:443

88.150.197.186:443

62.108.35.204:443

45.155.173.196:443

51.89.177.18:443

194.5.249.107:443

195.123.241.182:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      7974d6324dbba7811d9a59dd5784751536a35689a50609e2739ba3370c70aa43.exe

    • Size

      296KB

    • MD5

      cf63b9cc0187cd8344b71464c0172ab8

    • SHA1

      c91688c5c546720c26e7d0b72ecf6ecc42669bbf

    • SHA256

      7974d6324dbba7811d9a59dd5784751536a35689a50609e2739ba3370c70aa43

    • SHA512

      41fa3692ef4268121ae04b73c18a77bbfdf264aca50767b22d635e99718ca239fed7a574185894632bb72b5ec50d668699fea38016e67def5a06e1840d05bd5d

    • SSDEEP

      6144:BBhyasViILrAy8rmpWDTNMHZn66EjAKR1jVqAqKx4+6As6ZhM76f+A:BLWyUh6VAKRVEvKadAs6QaZ

    Score
    10/10
    trickbotmor127bankerdavediscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks