General

  • Target

    8dd87435b027c0acb17e1773d7f75288f81e911a861f85a06cafa63454522264

  • Size

    440KB

  • Sample

    201115-d7hqgx4fae

  • MD5

    aeed8e83aa8c0686837512bcd97004ff

  • SHA1

    4cde946babc4ef3428688989364450c55bf6e239

  • SHA256

    8dd87435b027c0acb17e1773d7f75288f81e911a861f85a06cafa63454522264

  • SHA512

    b769ae474485acb128b950939b19bc469df21abe393540d60f2a0d19987517087e3134c8b44d2186fc4c933b5a193f2ba804846e97e51f35544bf5f7f16e074e

Malware Config

Extracted

Family

trickbot

Version

1000511

Botnet

lib728

C2

5.182.211.215:443

144.91.76.208:443

185.99.2.57:443

134.119.191.38:443

195.123.238.17:443

95.171.16.42:443

85.204.116.238:443

185.234.72.242:443

178.157.82.227:443

185.90.61.9:443

45.148.120.205:443

85.204.116.241:443

5.1.81.68:443

51.81.112.191:443

23.239.84.138:443

194.5.250.180:443

194.87.93.114:443

190.214.13.2:449

181.129.104.139:449

181.112.157.42:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      8dd87435b027c0acb17e1773d7f75288f81e911a861f85a06cafa63454522264

    • Size

      440KB

    • MD5

      aeed8e83aa8c0686837512bcd97004ff

    • SHA1

      4cde946babc4ef3428688989364450c55bf6e239

    • SHA256

      8dd87435b027c0acb17e1773d7f75288f81e911a861f85a06cafa63454522264

    • SHA512

      b769ae474485acb128b950939b19bc469df21abe393540d60f2a0d19987517087e3134c8b44d2186fc4c933b5a193f2ba804846e97e51f35544bf5f7f16e074e

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks