Overview

overview

10

Static

static

3

jaffacakes...xj.exe

windows10-2004-x64

10

jaffacakes...xj.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan.Win32.Trickster.axj.a7e9b26f2008bd9f73e8423703623d24
  • Size 401KB
  • Sample261012-mxrt3azv2r
  • SHA256 b654e1aa4f40e399ee89c15319d25ba0b4de5180c734e43651e462729f739577
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trickbotkas80bankerdiscoverypersistencetrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000083

Botnet

  • kas80

C2

  • 187.191.0.42:449

  • 187.188.162.150:449

  • 185.28.63.109:449

  • 79.106.41.23:449

  • 83.0.245.234:449

  • 213.241.29.89:449

  • 62.109.31.123:443

  • 92.63.106.191:443

  • 92.63.107.14:443

  • 194.87.145.199:443

  • 93.95.97.87:443

  • 95.213.200.40:443

  • 95.213.237.29:443

  • 82.146.62.66:443

  • 95.213.204.139:443

  • 194.87.103.127:443

  • 82.202.236.42:443

  • 92.63.107.222:443

  • 92.63.104.211:443

  • 62.109.25.3:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target
      jaffacakes118_Trojan.Win32.Trickster.axj.a7e9b26f2008bd9f73e8423703623d24
    • Size 401KB
    • SHA256 b654e1aa4f40e399ee89c15319d25ba0b4de5180c734e43651e462729f739577
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankerkas80discoverytrickbotpersistencetrojan

    • Family: Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks