Overview

overview

10

Static

static

3

c6f319a3ed...40.dll

windows7-x64

10

c6f319a3ed...40.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_9bb74e2a1b3925184140f5a771b1e4638dfb5c61941bbc0b52809b3ca76b4887

  • Size

    306KB

  • Sample

    241222-jprbsazpck

  • MD5

    d379426800655513192e568a2fc622cc

  • SHA1

    0fb3e0593c4cdaa16e268c14b8af10c48adf88e7

  • SHA256

    9bb74e2a1b3925184140f5a771b1e4638dfb5c61941bbc0b52809b3ca76b4887

  • SHA512

    889617091b8362284422e6bc75c219c18ac7b024755919b145cd78989194af8d5992f1825d982426679eb9a9c4c3a913819945d1a2407568a62b0980d8f1ccb5

  • SSDEEP

    6144:jhoF7ek1f8XsbqWHgv/M3ya5+P7kBBtDlfYzrhZMLQB:jSdek1f8XSZAv/3a52iCrIUB

Score
10/10
trickbotnet9bankerdiscoverypackertrojan

Malware Config

Extracted

Family

trickbot

Version

2000029

Botnet

net9

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443
Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.dll

    • Size

      433KB

    • MD5

      eb70b6c24c0466954169882dbe5729a4

    • SHA1

      b81bcd8273854efb7d7b3fb5b982d75051a5d9a6

    • SHA256

      c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240

    • SHA512

      e90c5c958024734f089205e43f2c9a842e4fc68b8a7fcc7fc10754511a8b6bb724eab563bdd5141f9a1be634a3194f5b3abd14f97cdd0735c42f501d8f63e59f

    • SSDEEP

      12288:mLseU1D6L/hAsEYhbdf6YMvkm2kJYcxpGJ1:mLlS6L/G2f6jv7dJYYpGJ1

    Score
    10/10
    trickbotnet9bankerdiscoverypackertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

      packer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks