General
-
Target
Document_1774949536.zip
-
Size
21KB
-
Sample
201228-2asee1m4y6
-
MD5
e55038572c47d0204c7b044a9c833629
-
SHA1
f853b81e64903ff6eee6346299277f53d869560f
-
SHA256
8d9789f99f3df1965c00cf5cb8931f612d0eaedb39b1d7211f4330c07bb0a4ad
-
SHA512
ee70259a577956df82ec3c2bb8fb7e888e60ca83d5e8b7498e43b97e41475185cca50f7a96516d817f59a76fdeb9fdf0be1b2cfd305fef3dc32e843d9b1a8404
Malware Config
Extracted
http://vermapaints.com/pic.gif
Extracted
trickbot
100007
rob32
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
Document_1774949536.xlsm
-
Size
25KB
-
MD5
298483f4802705a367c6037ab170207a
-
SHA1
8296c8e8bb0f6aad94b187116a4d4abf5a63bbca
-
SHA256
dbfc4f6ed11c8fcf625f98b681e045ad469327f7025725835beb4eb07b78f819
-
SHA512
c8669baa01f32f3977a213c13dd05ca879bbfd33323cdcca5455b597f78518c54dc945707cbb736d036902e0b71dcb62da48a4db613dcda8e517b6fdc5074b5f
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-