trickbot | 4cac9f93754001e9a0b58e067beefa5ae738fcf1af0b3e75f0e4704e1cbc6982 | Triage

Sharing

General

Target

136b345a239295acc0329ae85463e0b249ee43f2409efef6b003dd31a10b40d6
Size

274KB
Sample

201017-bqw4bkj78x
MD5

9e8f28c644963f2c7b73c865bf83bdfa
SHA1

274626125fe2645ad6ea50ba4c3950eca4ef73b3
SHA256

4cac9f93754001e9a0b58e067beefa5ae738fcf1af0b3e75f0e4704e1cbc6982
SHA512

6c4a6d2b87251384bcc8550a5b65caab25ec88d0cf901d9a32077346297cd7add6b1b4d38211671b35b14cd6b19a5ab3ab25f1be4d96ee2a74f6d4364d1b8764

Score

10^/10

trickbot ono76 banker trojan

Malware Config

Extracted

Family

trickbot

Version

1000514

Botnet

ono76

C2

51.89.163.40:443

89.223.126.186:443

45.67.231.68:443

148.251.185.165:443

194.87.110.144:443

213.32.84.27:443

185.234.72.35:443

45.89.125.148:443

195.123.240.104:443

185.99.2.243:443

5.182.211.223:443

195.123.240.113:443

85.204.116.173:443

5.152.210.188:443

103.36.48.103:449

36.94.33.102:449

36.91.87.227:449

177.190.69.162:449

103.76.169.213:449

179.97.246.23:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  136b345a239295acc0329ae85463e0b249ee43f2409efef6b003dd31a10b40d6.vbe
- Size
  
  636KB
- MD5
  
  15810fb5f100a3a2d21e4c2288dc1a88
- SHA1
  
  834308004280f11a459f764d9e2339c34dc5d7f1
- SHA256
  
  136b345a239295acc0329ae85463e0b249ee43f2409efef6b003dd31a10b40d6
- SHA512
  
  431b31281a4b3d99fe2f9a0900a66b5eb9fc7deeae3394501fbc46ecd8d249415014f524f255a629d1f8ee3776d0b3cc8ff76d07beb7ec9c7c33632196ecaf87
Score

10^/10

trojan banker trickbot
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Loads dropped DLL
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

trojanbankertrickbot