Overview

overview

10

Static

static

sample.exe

windows7_x64

10

sample.exe

windows10_x64

10

Resubmissions

05-12-2020 17:56

201205-ew81apm7yx 10

04-12-2020 21:51

201204-yz325t8w7x 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3.bin.sample.gz

  • Size

    660KB

  • Sample

    201204-yz325t8w7x

  • MD5

    2747363745bf1d01c7e4dcd56702b1bc

  • SHA1

    3c30759499c306d60f9194d7b05ce8e0b9b1d264

  • SHA256

    4704501157675a1efd5f62210297fc25a48dd52ce320ac4e67489040f6e1d335

  • SHA512

    357adc02e8a5599fa33f544ade307882a29d07628ec11992b28ee5ff9582e1008646732003b5f9826593a2c36204753533e3b803ce34fb35184ae020e29e4fbf

Score
10/10
trickbottar3bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100003

Botnet

tar3

C2

102.164.206.129:449

103.131.156.21:449

103.131.157.102:449

103.131.157.161:449

103.146.232.5:449

103.150.68.124:449

103.156.126.232:449

103.30.85.157:449

103.52.47.20:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      sample

    • Size

      660KB

    • MD5

      c252603232987121f642be93e9e39348

    • SHA1

      9a06574b7f9f732cf6265fe0aff4c133c1cb8314

    • SHA256

      77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3

    • SHA512

      70630a8d2c467a6fed99443da2a776c67b6f819c58f5c77d6af8e441a53c891eb169c27a5ee4b5f799d3d51df922d9688d1f4edd55aa6b094d1422291681dc7e

    Score
    10/10
    trickbottar3bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks