trickbot

General

Target

0eefd7ae0d678d8e9426a3f2344baea842b09d9f60f23564e9ca38b36a2c7866
Size

360KB
Sample

200211-9g3efmlf9e
MD5

f5813544ad340621b4dc8097f9a5bfd0
SHA1

903a640a5074b6025d360f95ad246868dfa678fe
SHA256

0eefd7ae0d678d8e9426a3f2344baea842b09d9f60f23564e9ca38b36a2c7866
SHA512

ce90441df6ea756cec2aaacfa3bf1796cfbe880522837aa2a9f09750dd9bf35df0e8495f1f89c9080c21224f94b6caa2abe7b0f0f08100a4444ed0c2fa8ffb58

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

1000497

Botnet

jim666

C2

5.182.210.226:443

5.182.210.246:443

82.146.62.52:443

198.8.91.10:443

195.123.221.53:443

51.89.115.116:443

164.68.120.56:443

85.204.116.237:443

5.2.75.167:443

93.189.42.146:443

185.252.144.174:443

81.177.165.145:443

217.107.34.151:443

146.185.219.165:443

194.87.238.87:443

146.185.253.18:443

194.5.250.155:443

195.123.216.223:443

185.99.2.160:443

5.182.210.230:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  0eefd7ae0d678d8e9426a3f2344baea842b09d9f60f23564e9ca38b36a2c7866
- Size
  
  360KB
- MD5
  
  f5813544ad340621b4dc8097f9a5bfd0
- SHA1
  
  903a640a5074b6025d360f95ad246868dfa678fe
- SHA256
  
  0eefd7ae0d678d8e9426a3f2344baea842b09d9f60f23564e9ca38b36a2c7866
- SHA512
  
  ce90441df6ea756cec2aaacfa3bf1796cfbe880522837aa2a9f09750dd9bf35df0e8495f1f89c9080c21224f94b6caa2abe7b0f0f08100a4444ed0c2fa8ffb58
Score

10^/10

trickbot jim666 banker trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Trickbot x86 loader

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2