Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_0179213144248d1b44919e3b69726e266a80ceced9b9e30d8e5f710f6f009614

  • Size

    2.1MB

  • Sample

    241224-a5w3jawrd1

  • MD5

    c2a4d5818fee52303aedffebc3dc74a5

  • SHA1

    d689d7257ff3ba192139234a07ae72605f6c1999

  • SHA256

    0179213144248d1b44919e3b69726e266a80ceced9b9e30d8e5f710f6f009614

  • SHA512

    d58bf10d1558b51e98e335e4b1e4081b541a63f082148c59ea2498e87ce2c662aaa05525bc051da1b30cbfe83829c3261606fa16fef866af12589e823c10ae12

  • SSDEEP

    3072:mUd2wnncoy08JVRgsLFu17v5PjGjGIGI5JRZiGM652qRX8tfkFdRYCWcFEa+kRY:mmn1P8JV7YD5qfrdZiGhNW87zia+GY

Malware Config

Extracted

Family

trickbot

Version

100021

Botnet

rob142

C2

181.129.85.98:443

189.112.119.205:443

189.51.118.78:443

186.121.214.106:443

49.176.188.184:443

61.69.102.170:443

213.32.252.221:443

89.46.216.2:443

103.36.79.3:443

103.108.97.51:443

95.140.217.242:443

41.175.22.226:443

190.109.169.161:443

186.159.12.18:443

190.109.171.17:443

181.196.148.202:443

186.47.75.58:443

186.42.212.30:443

190.214.21.14:443

187.108.32.133:443

Attributes
  • autorun

ecc_pubkey.base64
1
RUNTMzAAAABbfmkJRvwyw7iFkX40hL2HwsUeOSZZZo0FRRWGkY6J1+gf3YKq13Ee4sY3Jb9/0myCr0MwzNK1K2l5yuY87nW29Q/yjMJG0ISDj0HNBC3G+ZGta6Oi9QkjCwnNGbw2hQ4=

Targets

    • Target

      JaffaCakes118_0179213144248d1b44919e3b69726e266a80ceced9b9e30d8e5f710f6f009614

    • Size

      2.1MB

    • MD5

      c2a4d5818fee52303aedffebc3dc74a5

    • SHA1

      d689d7257ff3ba192139234a07ae72605f6c1999

    • SHA256

      0179213144248d1b44919e3b69726e266a80ceced9b9e30d8e5f710f6f009614

    • SHA512

      d58bf10d1558b51e98e335e4b1e4081b541a63f082148c59ea2498e87ce2c662aaa05525bc051da1b30cbfe83829c3261606fa16fef866af12589e823c10ae12

    • SSDEEP

      3072:mUd2wnncoy08JVRgsLFu17v5PjGjGIGI5JRZiGM652qRX8tfkFdRYCWcFEa+kRY:mmn1P8JV7YD5qfrdZiGhNW87zia+GY

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.