General

  • Target

    39b382ded4dd1eccb9f9b3929c9de744.exe

  • Size

    612KB

  • Sample

    201230-43gv9e69nj

  • MD5

    39b382ded4dd1eccb9f9b3929c9de744

  • SHA1

    760b9682c0d4f4006b2e6566cf2a70723510fcd4

  • SHA256

    02a31022e1e829f4d6f854ad5c8c03fd0350dfb5b1f74b585dcf419711e185d4

  • SHA512

    25ecfe0ab976e0e4077e2c43a3a52b6e11e4ccb1ef0cb071adb8a823b709b4dd3416a7c1095666fae7663db95454e5682728949c17eabfaee3002e1e4900ac6c

Malware Config

Extracted

Family

trickbot

Version

100008

Botnet

mor6

C2

103.231.115.106:449

117.222.63.100:449

117.254.58.83:449

149.54.11.54:449

170.82.4.64:449

177.11.12.93:449

182.16.187.251:449

187.108.86.48:449

190.152.88.57:449

203.88.149.33:449

36.89.191.119:449

41.159.31.227:449

85.202.128.243:449

92.204.160.82:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.48:449

102.164.208.44:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      39b382ded4dd1eccb9f9b3929c9de744.exe

    • Size

      612KB

    • MD5

      39b382ded4dd1eccb9f9b3929c9de744

    • SHA1

      760b9682c0d4f4006b2e6566cf2a70723510fcd4

    • SHA256

      02a31022e1e829f4d6f854ad5c8c03fd0350dfb5b1f74b585dcf419711e185d4

    • SHA512

      25ecfe0ab976e0e4077e2c43a3a52b6e11e4ccb1ef0cb071adb8a823b709b4dd3416a7c1095666fae7663db95454e5682728949c17eabfaee3002e1e4900ac6c

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks