Overview

overview

10

Static

static

sample.exe

windows7_x64

10

sample.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    447e9c417b7c9cf6e03086ca1da31a718e5159f454bf91efad09f240572db967.bin.sample.gz

  • Size

    284KB

  • Sample

    201204-2kx1nk4tgn

  • MD5

    e5754ac02c81cf6957180014228dbc68

  • SHA1

    b7b192d1eb1859a0c24c08d3aff40ddcc15a79e4

  • SHA256

    dde87eaee93e96c14a683e7ac0ae4cbcc30265fc17067fe3fd0f159aa3c2aeeb

  • SHA512

    c3577e2391c1e6fa9c93fefe8a0381bf310aa8fe94266ea0f4196e69e86d2668d1439a44b1db2051dba1f8f947be325a6db46f8048b210f78577e76c3c4ec871

Score
10/10
trickbotyas31bankerdavetrojan

Malware Config

Extracted

Family

trickbot

Version

1000508

Botnet

yas31

C2

164.132.255.19:443

188.119.113.114:443

176.119.159.147:443

51.254.164.243:443

178.156.202.251:443

185.234.72.24:443

194.5.250.52:443

217.12.209.244:443

185.99.2.123:443

185.198.57.75:443

93.189.42.81:443

148.251.185.186:443

79.137.101.2:443

51.89.115.121:443

91.200.100.84:443

194.5.250.69:443

185.14.30.45:443

185.99.2.142:443

107.175.133.162:443

5.196.247.14:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      sample

    • Size

      284KB

    • MD5

      99b81672c6ec04e7e6e6063b40d9127c

    • SHA1

      2f29fb6c87fd77f2ff5df3312e0c0667b76af3cf

    • SHA256

      447e9c417b7c9cf6e03086ca1da31a718e5159f454bf91efad09f240572db967

    • SHA512

      b0e877ed117457a8a4458816309c8e68a911e0b6d17d449730e09beec84174abd3b97493dcea6b3dc55617471797371d4d6cf84c58f117b8bf826da0349d3e8f

    Score
    10/10
    trickbotyas31bankerdavetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

      dave
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks