General
-
Target
SecuriteInfo.com.Variant.Razy.820175.2669.14996
-
Size
612KB
-
Sample
201230-avpbgzh3fa
-
MD5
ee014fedcaaeb2e97584045fcf0612d2
-
SHA1
1cdbcb183992b1625da17d6ef3444597b70a3fed
-
SHA256
3a214b848b9d317e2c8dfdc7a2e55ee7893b6e4aadc335992d3425480c7eb8b6
-
SHA512
e6fa51ea1590177013cb6f7dc4bc9bec9fd546c03f98f3eac46f32f98074765eb7b928a76e3bdf3cad6cb8c3543900cbc91f29fe7cf46e40513d8a22c7d04e6b
Malware Config
Extracted
trickbot
100008
mor6
103.231.115.106:449
117.222.63.100:449
117.254.58.83:449
149.54.11.54:449
170.82.4.64:449
177.11.12.93:449
182.16.187.251:449
187.108.86.48:449
190.152.88.57:449
203.88.149.33:449
36.89.191.119:449
41.159.31.227:449
85.202.128.243:449
92.204.160.82:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
SecuriteInfo.com.Variant.Razy.820175.2669.14996
-
Size
612KB
-
MD5
ee014fedcaaeb2e97584045fcf0612d2
-
SHA1
1cdbcb183992b1625da17d6ef3444597b70a3fed
-
SHA256
3a214b848b9d317e2c8dfdc7a2e55ee7893b6e4aadc335992d3425480c7eb8b6
-
SHA512
e6fa51ea1590177013cb6f7dc4bc9bec9fd546c03f98f3eac46f32f98074765eb7b928a76e3bdf3cad6cb8c3543900cbc91f29fe7cf46e40513d8a22c7d04e6b
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-