General

  • Target

    JaffaCakes118_b0705927f9f2aaf27d35655f5919414ec1c2b40ed7cb47287c64e99477a3c740

  • Size

    573KB

  • Sample

    241222-kek8fs1ldw

  • MD5

    2a82506aabdbe1f8f1df742c3a118603

  • SHA1

    716bf12fe7b3be72c9ad9de18a7eeb67b5c35ffc

  • SHA256

    b0705927f9f2aaf27d35655f5919414ec1c2b40ed7cb47287c64e99477a3c740

  • SHA512

    10ad4a7f88dd1d2e47f967aa1ec7f0c468e90fbd388f72734726586bc31e17fba7dc6f6774152ddf3837a7372737115b9bfad66579e20d57765eb20f95a4b0a9

  • SSDEEP

    12288:KZH7ymEvGjVj2VNYz6GC25e9+eqermKANUQZNrNzW6Tbh8EGpnMqBK0xZe:w+DGR3z6GC251fChAzDNzW2hnsnBK0x8

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

get1

C2

gasratab.com:443

parismana.com:443

londonho.com:443

Attributes
  • autorun

ecc_pubkey.base64

Targets

    • Target

      JaffaCakes118_b0705927f9f2aaf27d35655f5919414ec1c2b40ed7cb47287c64e99477a3c740

    • Size

      573KB

    • MD5

      2a82506aabdbe1f8f1df742c3a118603

    • SHA1

      716bf12fe7b3be72c9ad9de18a7eeb67b5c35ffc

    • SHA256

      b0705927f9f2aaf27d35655f5919414ec1c2b40ed7cb47287c64e99477a3c740

    • SHA512

      10ad4a7f88dd1d2e47f967aa1ec7f0c468e90fbd388f72734726586bc31e17fba7dc6f6774152ddf3837a7372737115b9bfad66579e20d57765eb20f95a4b0a9

    • SSDEEP

      12288:KZH7ymEvGjVj2VNYz6GC25e9+eqermKANUQZNrNzW6Tbh8EGpnMqBK0xZe:w+DGR3z6GC251fChAzDNzW2hnsnBK0x8

    • Contacts Bazar domain

      Uses Emercoin blockchain domains associated with Bazar backdoor/loader.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Trickbot family

MITRE ATT&CK Enterprise v15

Tasks