General

  • Target

    2a8c90837c9111bfdea7eb357b2346471d18a7bc74778ca8f9cb6322112a55f4

  • Size

    556KB

  • Sample

    201113-gzlcpvbfxe

  • MD5

    f47106fcc8611a07c36b386cbb9dbca4

  • SHA1

    77da75d5295a7999c3b050b7c2cf8bdc447a045b

  • SHA256

    2a8c90837c9111bfdea7eb357b2346471d18a7bc74778ca8f9cb6322112a55f4

  • SHA512

    93dbde611a483837fc4d0b62097dae7fabf7469f85c050413a8aedb08bf82f61d47cb11ea267b2c70d0629c5eb03cafc65911a854fbed3c3125ce43754e03e90

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

lib800

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      2a8c90837c9111bfdea7eb357b2346471d18a7bc74778ca8f9cb6322112a55f4

    • Size

      556KB

    • MD5

      f47106fcc8611a07c36b386cbb9dbca4

    • SHA1

      77da75d5295a7999c3b050b7c2cf8bdc447a045b

    • SHA256

      2a8c90837c9111bfdea7eb357b2346471d18a7bc74778ca8f9cb6322112a55f4

    • SHA512

      93dbde611a483837fc4d0b62097dae7fabf7469f85c050413a8aedb08bf82f61d47cb11ea267b2c70d0629c5eb03cafc65911a854fbed3c3125ce43754e03e90

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks