Overview

overview

10

Static

static

3

jaffacakes...bg.exe

windows10-2004-x64

10

jaffacakes...bg.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Dropper.Win32.Agent.bjubbg.1bf73a1452149f062132ebd668e800ca
  • Size 277KB
  • Sample261006-styq4aas3v
  • SHA256 189efbfa66e3a7be1ce6605c127eadf261cfd0309ea8239ee8098b3bc75b8ec8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trickbotsolinger20bankerdiscoverypersistencetrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000031

Botnet

  • solinger20

C2

  • 194.87.146.146:443

  • 37.46.134.189:443

  • 195.133.146.18:443

  • 82.202.236.66:443

  • 195.133.147.149:443

  • 194.87.93.169:443

  • 92.53.78.79:443

  • 95.213.237.224:443

  • 194.87.110.162:443

  • 194.87.102.206:443

  • 92.53.91.59:443

  • 188.120.242.117:443

  • 92.53.77.120:443

  • 185.236.130.97:443

  • 62.109.3.136:443

  • 194.87.103.178:443

  • 212.109.197.115:443

  • 91.240.86.21:443

  • 83.220.168.63:443

  • 91.240.86.137:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target
      jaffacakes118_Trojan-Dropper.Win32.Agent.bjubbg.1bf73a1452149f062132ebd668e800ca
    • Size 277KB
    • SHA256 189efbfa66e3a7be1ce6605c127eadf261cfd0309ea8239ee8098b3bc75b8ec8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankersolinger20discoverytrickbotpersistencetrojan

    • Family: Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks