General
-
Target
Annual.bin
-
Size
233KB
-
Sample
201110-86ndvnrnn6
-
MD5
edeb0079066374d0b5d522646e0a2a62
-
SHA1
3a08af50c97c60b8f5984f95d31e9472e5eb1cc5
-
SHA256
437fc85d1ec4b73ef1a54b8626b92ca0d50a64c901dc17c19eb74d929f857d9b
-
SHA512
d01bae4af74bca1f1fd9c11e720bdd7f7aa1abb92f9dc626b41a7430236711984d8e7773683b724453f3dd62344664e192d8038c7a6f43c5d25757556434098d
Static task
static1
Behavioral task
behavioral1
Sample
Annual.bin.exe
Resource
win7v20201028
Malware Config
Extracted
trickbot
100001
tar2
66.85.183.5:443
185.163.47.157:443
94.140.115.99:443
195.123.240.40:443
195.123.241.226:443
-
autorunName:pwgrab
Targets
-
-
Target
Annual.bin
-
Size
233KB
-
MD5
edeb0079066374d0b5d522646e0a2a62
-
SHA1
3a08af50c97c60b8f5984f95d31e9472e5eb1cc5
-
SHA256
437fc85d1ec4b73ef1a54b8626b92ca0d50a64c901dc17c19eb74d929f857d9b
-
SHA512
d01bae4af74bca1f1fd9c11e720bdd7f7aa1abb92f9dc626b41a7430236711984d8e7773683b724453f3dd62344664e192d8038c7a6f43c5d25757556434098d
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-