Overview

overview

10

Static

static

Default

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YAS2231.exe

  • Size

    284KB

  • Sample

    201127-n3aveb9l1e

  • MD5

    99b81672c6ec04e7e6e6063b40d9127c

  • SHA1

    2f29fb6c87fd77f2ff5df3312e0c0667b76af3cf

  • SHA256

    447e9c417b7c9cf6e03086ca1da31a718e5159f454bf91efad09f240572db967

  • SHA512

    b0e877ed117457a8a4458816309c8e68a911e0b6d17d449730e09beec84174abd3b97493dcea6b3dc55617471797371d4d6cf84c58f117b8bf826da0349d3e8f

Score
10/10
trickbotyas31bankerdavespywaretrojan

Malware Config

Extracted

Family

trickbot

Version

1000508

Botnet

yas31

C2

164.132.255.19:443

188.119.113.114:443

176.119.159.147:443

51.254.164.243:443

178.156.202.251:443

185.234.72.24:443

194.5.250.52:443

217.12.209.244:443

185.99.2.123:443

185.198.57.75:443

93.189.42.81:443

148.251.185.186:443

79.137.101.2:443

51.89.115.121:443

91.200.100.84:443

194.5.250.69:443

185.14.30.45:443

185.99.2.142:443

107.175.133.162:443

5.196.247.14:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      YAS2231.exe

    • Size

      284KB

    • MD5

      99b81672c6ec04e7e6e6063b40d9127c

    • SHA1

      2f29fb6c87fd77f2ff5df3312e0c0667b76af3cf

    • SHA256

      447e9c417b7c9cf6e03086ca1da31a718e5159f454bf91efad09f240572db967

    • SHA512

      b0e877ed117457a8a4458816309c8e68a911e0b6d17d449730e09beec84174abd3b97493dcea6b3dc55617471797371d4d6cf84c58f117b8bf826da0349d3e8f

    Score
    10/10
    trickbotyas31bankerdavespywaretrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

      dave

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks