Overview

overview

10

Static

static

3

JaffaCakes...7e.dll

windows7-x64

10

JaffaCakes...7e.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_81a999fd79a5bae6706f9dddae1329babe0f88e62d3927b45d06cbea86c80c7e

  • Size

    706KB

  • Sample

    241224-am3glawmev

  • MD5

    bbd7395258392ebf1540b6b06eaa3053

  • SHA1

    d7f2c10fa715a2f939eb863c164bbca04ef8644c

  • SHA256

    81a999fd79a5bae6706f9dddae1329babe0f88e62d3927b45d06cbea86c80c7e

  • SHA512

    784e2bb4a3d7146d02a1dcea9b576d6d91fecba1d29484d5b16f545cd02ddbb7cf57c5270b9cf28156b5d7e587fadf86d00212939412ecad9ca1c940f7b4c837

  • SSDEEP

    12288:7NP2qgMhn9VbKac3cM15xIKR5pduDkgcKOuCEUz+ovYJXA8ZRA5cXO/+uBY2F0cC:RPp2abM15xIxD4KXJg/vYRbKDBhF1TSz

Score
10/10
trickbotrob136bankerdiscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

rob136

C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443
Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      JaffaCakes118_81a999fd79a5bae6706f9dddae1329babe0f88e62d3927b45d06cbea86c80c7e

    • Size

      706KB

    • MD5

      bbd7395258392ebf1540b6b06eaa3053

    • SHA1

      d7f2c10fa715a2f939eb863c164bbca04ef8644c

    • SHA256

      81a999fd79a5bae6706f9dddae1329babe0f88e62d3927b45d06cbea86c80c7e

    • SHA512

      784e2bb4a3d7146d02a1dcea9b576d6d91fecba1d29484d5b16f545cd02ddbb7cf57c5270b9cf28156b5d7e587fadf86d00212939412ecad9ca1c940f7b4c837

    • SSDEEP

      12288:7NP2qgMhn9VbKac3cM15xIKR5pduDkgcKOuCEUz+ovYJXA8ZRA5cXO/+uBY2F0cC:RPp2abM15xIxD4KXJg/vYRbKDBhF1TSz

    Score
    10/10
    trickbotrob136bankerdiscoverytrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks