trickbot | 763d7811a588969bfea3613ec808234c13c867ded4dee150bc687be0665dcccb | Triage

Sharing

General

Target

sfc8b4.bin.zip
Size

326KB
Sample

201118-1etjfas4hn
MD5

652f566fd714d26b33cc67637f560d8d
SHA1

beaa21ffedbfde533105092691d7b5c6be3f1e10
SHA256

763d7811a588969bfea3613ec808234c13c867ded4dee150bc687be0665dcccb
SHA512

0912b703a73458bedf401777c443a36b31bf3363f674e8e23be118fa3a5c57120b6a2418272247ee2f602be220e54d677cc25b945e74427514c4d41e7d85f987

Score

10^/10

trickbot mor137 banker trojan

Malware Config

Extracted

Family

trickbot

Version

2000014

Botnet

mor137

C2

103.127.165.250:449

103.109.78.174:449

199.38.120.89:449

103.206.128.121:449

199.38.120.91:443

199.38.121.150:443

199.38.123.58:443

208.86.162.215:443

208.86.161.113:443

208.86.162.241:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  sfc8b4.bin
- Size
  
  788KB
- MD5
  
  a5a28b55cd644c7b83b4641c4fdbf3a5
- SHA1
  
  772851debc5ef85a750577ebbae3cf3592c0b3ce
- SHA256
  
  58c4bea082b2f44f0beab5356ae2bc9bc73c3f13ab0491861bc2ba24690da103
- SHA512
  
  72ab2ba476428714985da8d51d4a65dee188df05310202b49d7f19645bd316266a9744343d22482d45b7bdd18520395aefb5f5eab16f39633cadac675bbf5695
Score

10^/10

trickbot mor137 banker trojan
- Contacts Bazar domain
  Uses Emercoin blockchain domains associated with Bazar backdoor/loader.
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

trickbotmor137bankertrojan