Overview

overview

10

Static

static

SecuriteIn...47.exe

windows7_x64

10

SecuriteIn...47.exe

windows10_x64

10

Resubmissions

30/12/2020, 06:51

201230-yxxdjlnbpa10

30/12/2020, 06:47

201230-evn9r2jk8x10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SecuriteInfo.com.Variant.Razy.820175.14827.1747
  • Size 612KB
  • Sample201230-evn9r2jk8x
  • SHA256 7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc
  • MD5 SHA1 SHA512
Score
10/10
trickbotmor6bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 100008

Botnet

  • mor6

C2

  • 103.231.115.106:449

  • 117.222.63.100:449

  • 117.254.58.83:449

  • 149.54.11.54:449

  • 170.82.4.64:449

  • 177.11.12.93:449

  • 182.16.187.251:449

  • 187.108.86.48:449

  • 190.152.88.57:449

  • 203.88.149.33:449

  • 36.89.191.119:449

  • 41.159.31.227:449

  • 85.202.128.243:449

  • 92.204.160.82:449

  • 103.150.68.124:449

  • 103.126.185.7:449

  • 103.112.145.58:449

  • 103.110.53.174:449

  • 102.164.208.48:449

  • 102.164.208.44:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      SecuriteInfo.com.Variant.Razy.820175.14827.1747
    • Size 612KB
    • SHA256 7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbotmor6bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks