General
-
Target
76EA40DFDEE95B85F0E0B7F22DD533DF.xls
-
Size
45KB
-
Sample
201229-p1e4szj3ln
-
MD5
76ea40dfdee95b85f0e0b7f22dd533df
-
SHA1
7e4cf20e56a26f179a22c9463c5ce1d6a9d1a146
-
SHA256
5dd8f68a727f6c26277c01a652d9e9432d1b36733b7ccd9b7e9f901d7b5f4590
-
SHA512
fce7149fcffcde056868743378f0a3c038da64d202852e88a65664cc19cbe917c52b76d9a2f48d2db1721639f4577823108952bd1145d7cb8e3a46763425e31d
Malware Config
Extracted
http://hiperdoscolchoes.com/demoimg.gif
Extracted
trickbot
100008
rob33
103.231.115.106:449
117.222.63.100:449
117.254.58.83:449
149.54.11.54:449
170.82.4.64:449
177.11.12.93:449
182.16.187.251:449
187.108.86.48:449
190.152.88.57:449
203.88.149.33:449
36.89.191.119:449
41.159.31.227:449
85.202.128.243:449
92.204.160.82:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
76EA40DFDEE95B85F0E0B7F22DD533DF.xls
-
Size
45KB
-
MD5
76ea40dfdee95b85f0e0b7f22dd533df
-
SHA1
7e4cf20e56a26f179a22c9463c5ce1d6a9d1a146
-
SHA256
5dd8f68a727f6c26277c01a652d9e9432d1b36733b7ccd9b7e9f901d7b5f4590
-
SHA512
fce7149fcffcde056868743378f0a3c038da64d202852e88a65664cc19cbe917c52b76d9a2f48d2db1721639f4577823108952bd1145d7cb8e3a46763425e31d
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-