General

  • Target

    JaffaCakes118_32c45ec21bfd19a85aa59d09e8b480d4df7181108696ae3a5f744ed89eebd4f1

  • Size

    516KB

  • Sample

    241225-xpbg8atler

  • MD5

    d47d3ef583740ef470866feea45a37a8

  • SHA1

    6a3be8ac5027d72c6cdfc70f434b878e0847f1d3

  • SHA256

    32c45ec21bfd19a85aa59d09e8b480d4df7181108696ae3a5f744ed89eebd4f1

  • SHA512

    27d0093e14bb76d27ce3af97231f65d004fa0781c4483779c0ae2ef82e0e81ea2399ed29ef307c602b373e5dc4909611024a8e1f1bf22c46a223442269348514

  • SSDEEP

    12288:cbVMh0tRyr3W3SbniM+uwkMx8nXoTT0WJZmo:WMh0tRyn3lY8X2xJZmo

Malware Config

Extracted

Family

trickbot

Version

2000033

Botnet

tot153

C2

179.42.137.102:443

191.36.152.198:443

179.42.137.104:443

179.42.137.106:443

179.42.137.108:443

202.183.12.124:443

194.190.18.122:443

103.56.207.230:443

171.103.187.218:449

171.103.189.118:449

18.139.111.104:443

179.42.137.105:443

186.4.193.75:443

171.101.229.2:449

179.42.137.107:443

103.56.43.209:449

179.42.137.110:443

45.181.207.156:443

197.44.54.162:449

179.42.137.109:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64
1
RUNTMzAAAAAL/ZqmMPBLaRfg1hPOtFJrZz2Zi2/EC4B3fiX8VnaOUVKndBr+jEqWc7mw4v3ADTiwp64K5QKe1LZ27jUZxL4bWjxARPo85hv72nuedeZhRQ+adQQ/gIsV869MycRzghc=

Targets

    • Target

      JaffaCakes118_32c45ec21bfd19a85aa59d09e8b480d4df7181108696ae3a5f744ed89eebd4f1

    • Size

      516KB

    • MD5

      d47d3ef583740ef470866feea45a37a8

    • SHA1

      6a3be8ac5027d72c6cdfc70f434b878e0847f1d3

    • SHA256

      32c45ec21bfd19a85aa59d09e8b480d4df7181108696ae3a5f744ed89eebd4f1

    • SHA512

      27d0093e14bb76d27ce3af97231f65d004fa0781c4483779c0ae2ef82e0e81ea2399ed29ef307c602b373e5dc4909611024a8e1f1bf22c46a223442269348514

    • SSDEEP

      12288:cbVMh0tRyr3W3SbniM+uwkMx8nXoTT0WJZmo:WMh0tRyn3lY8X2xJZmo

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.