Overview

overview

10

Static

static

ACT96MC98SD.bin.dll

windows7_x64

10

ACT96MC98SD.bin.dll

windows10_x64

10

Resubmissions

18/11/2020, 11:32

201118-5rrxqk18yj10

06/11/2020, 15:10

201106-kxbznxg6dx10

25/10/2020, 17:59

201025-zgtkw9nk7x10

24/10/2020, 17:41

201024-89mfnb21be10

24/10/2020, 07:18

201024-ejsr16d3q610

Sharing

Copy URL Twitter E-mail

General

  • Target
    ACT96MC98SD.bin
  • Size 260KB
  • Sample201024-ejsr16d3q6
  • SHA256 4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9
  • MD5 SHA1 SHA512
Score
10/10
trickbotono95bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 4294967043

Botnet

  • ono95

C2

  • 45.67.231.68:443

  • 92.62.65.163:449

  • 186.159.8.218:449

  • 200.116.232.186:449

  • 36.91.87.227:449

  • 103.76.169.213:449

  • 181.143.186.42:449

  • 179.127.88.41:449

  • 103.66.10.87:449

  • 199.38.120.77:449

  • 208.86.162.249:449

  • 199.38.120.90:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      ACT96MC98SD.bin
    • Size 260KB
    • SHA256 4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9
    • MD5 SHA1 SHA512
    Score
    10/10
    trojanbankertrickbot

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks