Overview

overview

10

Static

static

3

jaffacakes...yb.exe

windows10-2004-x64

10

jaffacakes...yb.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan.Win32.Trickster.ayb.a290540d45b7ee6f4360579fd7b279a5
  • Size 401KB
  • Sample261006-kabhfstgmf
  • SHA256 4cd32733722c4f8fa7993fb6bc997c8dbd1129678c427579774c99bef668e952
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trickbotser111417bankerdiscoverypersistencetrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000085

Botnet

  • ser111417

C2

  • 187.188.162.150:449

  • 185.28.63.109:449

  • 83.0.245.234:449

  • 213.241.29.89:449

  • 62.109.31.123:443

  • 92.63.107.14:443

  • 92.63.107.222:443

  • 92.63.104.211:443

  • 62.109.25.3:443

  • 62.109.26.208:443

  • 37.230.113.231:443

  • 149.154.69.126:443

  • 95.213.191.144:443

  • 82.202.226.229:443

  • 37.230.113.249:443

  • 149.154.69.129:443

  • 185.158.114.72:443

  • 179.43.160.50:443

  • 94.250.254.22:443

  • 149.154.70.248:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target
      jaffacakes118_Trojan.Win32.Trickster.ayb.a290540d45b7ee6f4360579fd7b279a5
    • Size 401KB
    • SHA256 4cd32733722c4f8fa7993fb6bc997c8dbd1129678c427579774c99bef668e952
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerser111417discoverytrickbotpersistencetrojan

    • Family: Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks