Overview

overview

10

Static

static

e21f86a032...25.exe

windows7_x64

10

e21f86a032...25.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e21f86a0329f9fca7eb0492f22d76125
  • Size 600KB
  • Sample201117-5htrw7hdq2
  • SHA256 c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
  • MD5 SHA1 SHA512
Score
10/10
trickbotlib7bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 2000016

Botnet

  • lib7

C2

  • 202.136.89.226:449

  • 202.169.244.252:449

  • 203.176.135.38:449

  • 212.3.104.50:449

  • 41.203.215.122:449

  • 41.41.179.239:449

  • 43.239.152.240:449

  • 43.242.141.59:449

  • 43.245.216.190:449

  • 43.255.113.180:449

  • 45.230.8.34:449

  • 45.233.25.6:449

  • 78.138.128.20:449

  • 49.156.41.74:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      e21f86a0329f9fca7eb0492f22d76125
    • Size 600KB
    • SHA256 c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbotlib7bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks