General
-
Target
pic.dll
-
Size
336KB
-
Sample
201228-hca2krrcae
-
MD5
b7e359f7786b76b7657659e7a6f12a5f
-
SHA1
097cc2d70de1779e76b76e32e4fd043cf31498b2
-
SHA256
f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01
-
SHA512
e5190c774ea8c1122c46ae307651ed2310ddc7e3570deeb35aca5919883cf0f88e5912acf641aaf072e7027ccd5eeed77ca625f41d774c6d072abcedc075a3db
Static task
static1
Behavioral task
behavioral1
Sample
pic.dll
Resource
win7v20201028
Malware Config
Extracted
trickbot
100007
rob32
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
pic.dll
-
Size
336KB
-
MD5
b7e359f7786b76b7657659e7a6f12a5f
-
SHA1
097cc2d70de1779e76b76e32e4fd043cf31498b2
-
SHA256
f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01
-
SHA512
e5190c774ea8c1122c46ae307651ed2310ddc7e3570deeb35aca5919883cf0f88e5912acf641aaf072e7027ccd5eeed77ca625f41d774c6d072abcedc075a3db
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-