Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...0e.exe

windows7-x64

10

JaffaCakes...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_643e0bba7fa32496066aba4aaabb023b1e1c6ff7c80389e32a7172a05d78680e

  • Size

    912KB

  • Sample

    241225-fw2jjsyqbr

  • MD5

    c22f5fcce005c2095d488b7aca623929

  • SHA1

    509962bc72898ed74f839bf423f3e85d959fdfa3

  • SHA256

    643e0bba7fa32496066aba4aaabb023b1e1c6ff7c80389e32a7172a05d78680e

  • SHA512

    7e2ecdee96e5762a0328e16e93d7cec7f896329babbb0875b970bac8d11be486db8525e9e8752ca4fc79d0b6bc71787387464da6f2a8d84565369555363b5e79

  • SSDEEP

    12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclwF8v1jBq9kKj7Nivzqg:2JkRBALfWye2er556CFBqnj7G+g

Score
10/10
trickbottot39bankerdiscoverytrojan

Malware Config

Extracted

Family

trickbot

Version

2000025

Botnet

tot39

C2

134.119.186.200:443

45.14.226.115:443

85.204.116.134:443

45.89.127.240:443

195.123.241.195:443

188.34.142.248:443

185.234.72.84:443

108.170.20.72:443

94.158.245.54:443

134.119.186.201:443

45.83.129.224:443

85.93.159.98:449

92.242.214.203:449

202.21.103.194:449

169.239.45.42:449

45.234.248.66:449

103.91.244.102:449

118.67.216.238:449

117.212.193.62:449

201.184.190.59:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      JaffaCakes118_643e0bba7fa32496066aba4aaabb023b1e1c6ff7c80389e32a7172a05d78680e

    • Size

      912KB

    • MD5

      c22f5fcce005c2095d488b7aca623929

    • SHA1

      509962bc72898ed74f839bf423f3e85d959fdfa3

    • SHA256

      643e0bba7fa32496066aba4aaabb023b1e1c6ff7c80389e32a7172a05d78680e

    • SHA512

      7e2ecdee96e5762a0328e16e93d7cec7f896329babbb0875b970bac8d11be486db8525e9e8752ca4fc79d0b6bc71787387464da6f2a8d84565369555363b5e79

    • SSDEEP

      12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclwF8v1jBq9kKj7Nivzqg:2JkRBALfWye2er556CFBqnj7G+g

    Score
    10/10
    trickbottot39bankerdiscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot family

      trickbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks