General
-
Target
Notification082520.doc
-
Size
285KB
-
Sample
200826-ggzfbj5kd2
-
MD5
f9cac6a43d460d5afc7428a1014a59af
-
SHA1
e7ae3fe9226a646711c7b31593e05368b4395d2a
-
SHA256
49a193afe2b75716f99338d1653dd321db5b0b4af3be050691605a861471be2e
-
SHA512
c12f18c7e4fee24fdcaf145178967295c5d11d6565590cc3f3db8fbf7d30432185651151156873142e52137ac50787d8d6f9d992ec4a149cbdf3a5926b59746d
Malware Config
Extracted
trickbot
1000513
chil103
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
-
autorunName:pwgrab
Targets
-
-
Target
Notification082520.doc
-
Size
285KB
-
MD5
f9cac6a43d460d5afc7428a1014a59af
-
SHA1
e7ae3fe9226a646711c7b31593e05368b4395d2a
-
SHA256
49a193afe2b75716f99338d1653dd321db5b0b4af3be050691605a861471be2e
-
SHA512
c12f18c7e4fee24fdcaf145178967295c5d11d6565590cc3f3db8fbf7d30432185651151156873142e52137ac50787d8d6f9d992ec4a149cbdf3a5926b59746d
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Blacklisted process makes network request
-
Loads dropped DLL
-