Overview

overview

10

Static

static

test

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8077593ca2a41a52e80d1a15a5a58015f8aafe321ba531dc1a07aa8ba9b5a182.dll

  • Size

    407KB

  • Sample

    201117-rvgh4fw7ee

  • MD5

    466d55f2a957d6ca5cd0619688c58a48

  • SHA1

    c4f05b5e8d705304b5b00c03c4c95ea9a308a382

  • SHA256

    8077593ca2a41a52e80d1a15a5a58015f8aafe321ba531dc1a07aa8ba9b5a182

  • SHA512

    d657180f2b70fd0944553e2cc56896dbd65f71d2d4801161903e57eb1407266ab1fdfe4e6aa570266695726f69ddf1de45fa1d0f5fc106bf13e5e5efdab3bb67

Score
10/10
trickbottar3bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100002

Botnet

tar3

C2

195.123.240.138:443

162.212.158.129:443

144.172.64.26:443

62.108.37.145:443

91.200.103.193:443

194.5.249.195:443

195.123.240.18:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      8077593ca2a41a52e80d1a15a5a58015f8aafe321ba531dc1a07aa8ba9b5a182.dll

    • Size

      407KB

    • MD5

      466d55f2a957d6ca5cd0619688c58a48

    • SHA1

      c4f05b5e8d705304b5b00c03c4c95ea9a308a382

    • SHA256

      8077593ca2a41a52e80d1a15a5a58015f8aafe321ba531dc1a07aa8ba9b5a182

    • SHA512

      d657180f2b70fd0944553e2cc56896dbd65f71d2d4801161903e57eb1407266ab1fdfe4e6aa570266695726f69ddf1de45fa1d0f5fc106bf13e5e5efdab3bb67

    Score
    10/10
    trickbottar3bankertrojan

    • Contacts Bazar domain

      Uses Emercoin blockchain domains associated with Bazar backdoor/loader.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks