General

  • Target

    6360ac5a1a5e7ff017e5a9a8bd35cb140cc1cab1.exe

  • Size

    668KB

  • Sample

    210104-n6eh54wx3e

  • MD5

    dbbdabb917e3edbd134e841829b723c5

  • SHA1

    6360ac5a1a5e7ff017e5a9a8bd35cb140cc1cab1

  • SHA256

    57923313973c7955afed23ce377688c7eb1cc088423f0678206b3fb16bd433ec

  • SHA512

    c907195d8f70f4cf9249aa5c84a5b96dd70e3fcda6a000297303255daf960557a045af95c5490c73dcda7bb64cd02e2d08a7a38162a5e66d0c3b625ac07094b7

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

mor9

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      6360ac5a1a5e7ff017e5a9a8bd35cb140cc1cab1.exe

    • Size

      668KB

    • MD5

      dbbdabb917e3edbd134e841829b723c5

    • SHA1

      6360ac5a1a5e7ff017e5a9a8bd35cb140cc1cab1

    • SHA256

      57923313973c7955afed23ce377688c7eb1cc088423f0678206b3fb16bd433ec

    • SHA512

      c907195d8f70f4cf9249aa5c84a5b96dd70e3fcda6a000297303255daf960557a045af95c5490c73dcda7bb64cd02e2d08a7a38162a5e66d0c3b625ac07094b7

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks