Overview

overview

10

Static

static

SecuriteIn...18.exe

windows7_x64

10

SecuriteIn...18.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Variant.Razy.820175.1205.12418

  • Size

    612KB

  • Sample

    201230-3atwl53t4s

  • MD5

    9249937f8b65eeaef25cf49a86b8e1c7

  • SHA1

    bab6aa3b076c6f956191c406047df30c73eb46db

  • SHA256

    f4f92a6ed4e8a88818db25823c89833364e1b4699588a631696262daa3212aee

  • SHA512

    e77e2d20e93902fb7f211b3320006f6e41de18f4572167aee7f536d740365aa0435500f9d6d096e4615c213ccef1477ce3d9848f3cf544a293c329d120eab28b

Score
10/10
trickbotmor6bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100008

Botnet

mor6

C2

103.231.115.106:449

117.222.63.100:449

117.254.58.83:449

149.54.11.54:449

170.82.4.64:449

177.11.12.93:449

182.16.187.251:449

187.108.86.48:449

190.152.88.57:449

203.88.149.33:449

36.89.191.119:449

41.159.31.227:449

85.202.128.243:449

92.204.160.82:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.48:449

102.164.208.44:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      SecuriteInfo.com.Variant.Razy.820175.1205.12418

    • Size

      612KB

    • MD5

      9249937f8b65eeaef25cf49a86b8e1c7

    • SHA1

      bab6aa3b076c6f956191c406047df30c73eb46db

    • SHA256

      f4f92a6ed4e8a88818db25823c89833364e1b4699588a631696262daa3212aee

    • SHA512

      e77e2d20e93902fb7f211b3320006f6e41de18f4572167aee7f536d740365aa0435500f9d6d096e4615c213ccef1477ce3d9848f3cf544a293c329d120eab28b

    Score
    10/10
    trickbotmor6bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks