Overview

overview

10

Static

static

3

jaffacakes...xn.exe

windows10-2004-x64

10

jaffacakes...xn.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan.Win32.Trickster.axn.95549a42ed7722870f7d603a8183be82
  • Size 444KB
  • Sample261012-mxtnnazv3j
  • SHA256 39c5322b5914fcc360745fd12bbfcab61e5659490d1f0c3e2162c9a24194ccfb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trickbottot1bankerdiscoverypersistencetrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000084

Botnet

  • tot1

C2

  • 187.188.162.150:449

  • 185.28.63.109:449

  • 83.0.245.234:449

  • 213.241.29.89:449

  • 62.109.31.123:443

  • 92.63.106.191:443

  • 92.63.107.14:443

  • 82.146.62.66:443

  • 92.63.107.222:443

  • 92.63.104.211:443

  • 62.109.25.3:443

  • 188.120.241.27:443

  • 179.43.160.41:443

  • 185.158.114.143:443

  • 179.43.147.220:443

  • 92.53.67.7:443

  • 78.155.206.172:443

  • 62.109.27.155:443

  • 62.109.26.208:443

  • 37.230.113.231:443

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target
      jaffacakes118_Trojan.Win32.Trickster.axn.95549a42ed7722870f7d603a8183be82
    • Size 444KB
    • SHA256 39c5322b5914fcc360745fd12bbfcab61e5659490d1f0c3e2162c9a24194ccfb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankertot1discoverytrickbotpersistencetrojan

    • Family: Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks