General

  • Target

    19cd0e5a221a36279a046ef3dc2cfa90aca933c9a09a47bbf70a666e17556813

  • Size

    332KB

  • Sample

    201113-2n8dzhv2ra

  • MD5

    5aa474d6a2ad892107496cb83a75c9de

  • SHA1

    aa851e5b4b2fec802fbd7830633a0a264d1e4f25

  • SHA256

    19cd0e5a221a36279a046ef3dc2cfa90aca933c9a09a47bbf70a666e17556813

  • SHA512

    9a47b785b658434636175192f02306a1f76861cb54fcd6baa3d95a4077aa7265d86a417c1667c93f0c83938378161b3313d681b32fec79242b4f335b9a1ead64

Malware Config

Extracted

Family

trickbot

Version

1000511

Botnet

lib724

C2

5.182.211.215:443

144.91.76.208:443

185.99.2.57:443

134.119.191.38:443

195.123.238.17:443

95.171.16.42:443

85.204.116.238:443

185.234.72.242:443

178.157.82.227:443

185.90.61.9:443

45.148.120.205:443

85.204.116.241:443

5.1.81.68:443

51.81.112.191:443

23.239.84.138:443

194.5.250.180:443

194.87.93.114:443

190.214.13.2:449

181.129.104.139:449

181.112.157.42:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      19cd0e5a221a36279a046ef3dc2cfa90aca933c9a09a47bbf70a666e17556813

    • Size

      332KB

    • MD5

      5aa474d6a2ad892107496cb83a75c9de

    • SHA1

      aa851e5b4b2fec802fbd7830633a0a264d1e4f25

    • SHA256

      19cd0e5a221a36279a046ef3dc2cfa90aca933c9a09a47bbf70a666e17556813

    • SHA512

      9a47b785b658434636175192f02306a1f76861cb54fcd6baa3d95a4077aa7265d86a417c1667c93f0c83938378161b3313d681b32fec79242b4f335b9a1ead64

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Dave packer

      Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks