General

  • Target

    AnnualReport.bin

  • Size

    233KB

  • Sample

    201110-v9t53j4lze

  • MD5

    e562d0767f189f0efa970ecb217e815d

  • SHA1

    c75ff2054c521f7eb3ead8a1494cb6809bcc3219

  • SHA256

    88565b64b4feccaaac0eb2529cf81b7b666c92589a814c859b276d5ec477f92e

  • SHA512

    faec2ce9911a991b3742d72052429e0b836d48b61dd95ccfa9c5014f736818b171b7ebe67a786121b7425915e8a1b4bb2d4ff42110f9cde01e68a2a6ddf5a6a4

Malware Config

Extracted

Family

trickbot

Version

100001

Botnet

tar2

C2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      AnnualReport.bin

    • Size

      233KB

    • MD5

      e562d0767f189f0efa970ecb217e815d

    • SHA1

      c75ff2054c521f7eb3ead8a1494cb6809bcc3219

    • SHA256

      88565b64b4feccaaac0eb2529cf81b7b666c92589a814c859b276d5ec477f92e

    • SHA512

      faec2ce9911a991b3742d72052429e0b836d48b61dd95ccfa9c5014f736818b171b7ebe67a786121b7425915e8a1b4bb2d4ff42110f9cde01e68a2a6ddf5a6a4

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks