General
-
Target
diego.png.dll
-
Size
340KB
-
Sample
201223-ysehxqmez2
-
MD5
d8a449d9a8aa11d58db91e3dc2387595
-
SHA1
0abb906db9988e2ff2621e68955b0e4470094a93
-
SHA256
da1ae69acf1b97bfac587addc9266155342bf8f2a7a80e0d09df9a577c39f7f9
-
SHA512
34bd9fc8d754bb4ec69c6f50194cf6e853b56ceff54bc36a85769e2b4271fda569d73a0aed2d9ecfb576cdba2829e70bc773882a2894ea6363302aa856be9aca
Malware Config
Extracted
trickbot
100007
rob23
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
diego.png.dll
-
Size
340KB
-
MD5
d8a449d9a8aa11d58db91e3dc2387595
-
SHA1
0abb906db9988e2ff2621e68955b0e4470094a93
-
SHA256
da1ae69acf1b97bfac587addc9266155342bf8f2a7a80e0d09df9a577c39f7f9
-
SHA512
34bd9fc8d754bb4ec69c6f50194cf6e853b56ceff54bc36a85769e2b4271fda569d73a0aed2d9ecfb576cdba2829e70bc773882a2894ea6363302aa856be9aca
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Blocklisted process makes network request
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-