Overview

overview

10

Static

static

dsuifvhfdkj.exe

windows7_x64

10

dsuifvhfdkj.exe

windows10_x64

10

Resubmissions

29-05-2020 14:45

200529-rd6rp5kdqe 10

22-05-2020 15:44

200522-c3g7kmykes 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dsuifvhfdkj.exe

  • Size

    552KB

  • Sample

    200529-rd6rp5kdqe

  • MD5

    b377527e76d5ba3b1d6a34605150b76c

  • SHA1

    a4da8940dc7e616b0be71c254435a74350924c35

  • SHA256

    77857312046d2a168e5c2ca3cd1465f6ad3fa4026b9e8792f03ccad038883826

  • SHA512

    016d672ed1167de27e8ca5c1c1f3713ab5dc28120b7cf10fdbd7e608de2727e0a7b278c58d37aa619dc5a7d57114e33fe81300a36058c6bc54c4504dd20d4240

Score
10/10
trickbotman7bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

man7

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      dsuifvhfdkj.exe

    • Size

      552KB

    • MD5

      b377527e76d5ba3b1d6a34605150b76c

    • SHA1

      a4da8940dc7e616b0be71c254435a74350924c35

    • SHA256

      77857312046d2a168e5c2ca3cd1465f6ad3fa4026b9e8792f03ccad038883826

    • SHA512

      016d672ed1167de27e8ca5c1c1f3713ab5dc28120b7cf10fdbd7e608de2727e0a7b278c58d37aa619dc5a7d57114e33fe81300a36058c6bc54c4504dd20d4240

    Score
    10/10
    trojanbankertrickbot

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks