General

  • Target

    apperolew.png

  • Size

    320KB

  • Sample

    210105-54vw6d5whx

  • MD5

    1a57412ab2edd77103fd75768ba146dd

  • SHA1

    81599a9b526c16b2a0a82cadcb8acaac6781ec81

  • SHA256

    7ab75bc888c6dd0457098d4539d9c86c3f1358a3b0c1a262f2bb8287e2bac917

  • SHA512

    7679b32035d95e5563ead9d54d8ef810c20913da702d983a23c66fc51e9f00647556bee2ba48803bd13b1340744c78aaea835bb9c247e616480595043de9566a

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

rob33

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      apperolew.png

    • Size

      320KB

    • MD5

      1a57412ab2edd77103fd75768ba146dd

    • SHA1

      81599a9b526c16b2a0a82cadcb8acaac6781ec81

    • SHA256

      7ab75bc888c6dd0457098d4539d9c86c3f1358a3b0c1a262f2bb8287e2bac917

    • SHA512

      7679b32035d95e5563ead9d54d8ef810c20913da702d983a23c66fc51e9f00647556bee2ba48803bd13b1340744c78aaea835bb9c247e616480595043de9566a

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks