Resubmissions

16-11-2020 14:52

201116-v6vf9v4752 10

15-11-2020 22:41

201115-dq3ycmvtns 10

General

  • Target

    6c4351f71620b31a44371350bd9dc1f7e581a8dd0506691eca6f9ed9d1d41732

  • Size

    660KB

  • Sample

    201116-v6vf9v4752

  • MD5

    ec54f8dc5c52b45031e0dae26410882c

  • SHA1

    aa836180c50ddba9d93e3a757ce31caa396b60ad

  • SHA256

    6c4351f71620b31a44371350bd9dc1f7e581a8dd0506691eca6f9ed9d1d41732

  • SHA512

    4917dd1e659afe938f48f90b0e92168e8598c982160a4135e3e13ebe28c3f0f595f4f9f2e5943d98d1d568d55a2ee6cca37345364d55abde71d1a99b398a9232

Malware Config

Extracted

Family

trickbot

Version

100001

Botnet

tar2

C2

66.85.183.5:443

185.163.47.157:443

94.140.115.99:443

195.123.240.40:443

195.123.241.226:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      6c4351f71620b31a44371350bd9dc1f7e581a8dd0506691eca6f9ed9d1d41732

    • Size

      660KB

    • MD5

      ec54f8dc5c52b45031e0dae26410882c

    • SHA1

      aa836180c50ddba9d93e3a757ce31caa396b60ad

    • SHA256

      6c4351f71620b31a44371350bd9dc1f7e581a8dd0506691eca6f9ed9d1d41732

    • SHA512

      4917dd1e659afe938f48f90b0e92168e8598c982160a4135e3e13ebe28c3f0f595f4f9f2e5943d98d1d568d55a2ee6cca37345364d55abde71d1a99b398a9232

    • Contacts Bazar domain

      Uses Emercoin blockchain domains associated with Bazar backdoor/loader.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks