trickbot | 4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21 | Triage

Sharing

General

Target

4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
Size

756KB
Sample

201120-gfwhcl59xn
MD5

d6408ae6bf86b97eadfb3f15bbfd7933
SHA1

dd877b59c9acd80535ad22bdc07525d536a41139
SHA256

4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
SHA512

f97da566db808c31ef9813124a7555ce35d3ead23238911935aa85845374dead962587cb252b7fda05c94c9b54b4555ec953e2d31316d2495c73aab148e88dec

Score

10^/10

trickbot rob6 banker trojan

Malware Config

Extracted

Family

trickbot

Version

100003

Botnet

rob6

C2

102.164.206.129:449

103.131.156.21:449

103.131.157.102:449

103.131.157.161:449

103.146.232.5:449

103.150.68.124:449

103.156.126.232:449

103.30.85.157:449

103.52.47.20:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
- Size
  
  756KB
- MD5
  
  d6408ae6bf86b97eadfb3f15bbfd7933
- SHA1
  
  dd877b59c9acd80535ad22bdc07525d536a41139
- SHA256
  
  4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
- SHA512
  
  f97da566db808c31ef9813124a7555ce35d3ead23238911935aa85845374dead962587cb252b7fda05c94c9b54b4555ec953e2d31316d2495c73aab148e88dec
Score

10^/10

trickbot rob6 banker trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

trickbotrob6bankertrojan

behavioral2