Overview

overview

10

Static

static

10 mins

windows7_x64

10

10 mins Win10

windows10_x64

10

Resubmissions

18-11-2020 11:32

201118-5rrxqk18yj 10

06-11-2020 15:10

201106-kxbznxg6dx 10

25-10-2020 17:59

201025-zgtkw9nk7x 10

24-10-2020 17:41

201024-89mfnb21be 10

24-10-2020 07:18

201024-ejsr16d3q6 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ACT96MC98SD.bin

  • Size

    260KB

  • Sample

    201118-5rrxqk18yj

  • MD5

    a7ddc63878394313d1a854e22b1c323f

  • SHA1

    f4dae0a6e298a594faa76aac8f362030226fab77

  • SHA256

    4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9

  • SHA512

    40fd700b40e52f426f4255bb7993736548f647f3a4831ee970f3128454cdabf15dc4f58c6c3a4fd635941f1703fce6acccfc355a94f7370a61649f577c553302

Score
10/10
trickbotono95bankerdavetrojan

Malware Config

Extracted

Family

trickbot

Version

4294967043

Botnet

ono95

C2

45.67.231.68:443

92.62.65.163:449

186.159.8.218:449

200.116.232.186:449

36.91.87.227:449

103.76.169.213:449

181.143.186.42:449

179.127.88.41:449

103.66.10.87:449

199.38.120.77:449

208.86.162.249:449

199.38.120.90:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      ACT96MC98SD.bin

    • Size

      260KB

    • MD5

      a7ddc63878394313d1a854e22b1c323f

    • SHA1

      f4dae0a6e298a594faa76aac8f362030226fab77

    • SHA256

      4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9

    • SHA512

      40fd700b40e52f426f4255bb7993736548f647f3a4831ee970f3128454cdabf15dc4f58c6c3a4fd635941f1703fce6acccfc355a94f7370a61649f577c553302

    Score
    10/10
    trickbotono95bankertrojandave

    • Contacts Bazar domain

      Uses Emercoin blockchain domains associated with Bazar backdoor/loader.

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Dave packer

      Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

      dave
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks