Overview

overview

10

Static

static

Forever

windows7_x64

10

Resubmissions

30/12/2020, 07:24

201230-2pnedj57aj10

28/12/2020, 18:56

201228-fmwh744fae10

Sharing

Copy URL Twitter E-mail

General

  • Target
    shiybnyrsolu.exe
  • Size 532KB
  • Sample201230-2pnedj57aj
  • SHA256 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
  • MD5 SHA1 SHA512
Score
10/10
trickbotmor5bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 100007

Botnet

  • mor5

C2

  • 103.87.25.220:443

  • 103.98.129.222:449

  • 41.243.29.182:449

  • 103.87.25.220:449

  • 196.45.140.146:449

  • 103.65.196.44:449

  • 103.65.195.95:449

  • 103.61.101.11:449

  • 103.61.100.131:449

  • 103.150.68.124:449

  • 103.137.81.206:449

  • 103.126.185.7:449

  • 103.112.145.58:449

  • 103.110.53.174:449

  • 102.164.208.48:449

  • 102.164.208.44:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target
      shiybnyrsolu.exe
    • Size 532KB
    • SHA256 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbotmor5bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix

Tasks