General
-
Target
apperolew.png
-
Size
320KB
-
Sample
210105-54vw6d5whx
-
MD5
1a57412ab2edd77103fd75768ba146dd
-
SHA1
81599a9b526c16b2a0a82cadcb8acaac6781ec81
-
SHA256
7ab75bc888c6dd0457098d4539d9c86c3f1358a3b0c1a262f2bb8287e2bac917
-
SHA512
7679b32035d95e5563ead9d54d8ef810c20913da702d983a23c66fc51e9f00647556bee2ba48803bd13b1340744c78aaea835bb9c247e616480595043de9566a
Static task
static1
Behavioral task
behavioral1
Sample
apperolew.png.dll
Resource
win7v20201028
Malware Config
Extracted
trickbot
100009
rob33
149.54.11.54:449
36.89.191.119:449
41.159.31.227:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.44:449
194.5.249.143:443
142.202.191.175:443
195.123.241.31:443
45.89.125.214:443
45.83.151.103:443
91.200.103.41:443
66.70.246.0:443
64.74.160.218:443
198.46.198.115:443
5.34.180.173:443
23.227.196.5:443
195.123.241.115:443
107.152.42.163:443
-
autorunName:pwgrab
Targets
-
-
Target
apperolew.png
-
Size
320KB
-
MD5
1a57412ab2edd77103fd75768ba146dd
-
SHA1
81599a9b526c16b2a0a82cadcb8acaac6781ec81
-
SHA256
7ab75bc888c6dd0457098d4539d9c86c3f1358a3b0c1a262f2bb8287e2bac917
-
SHA512
7679b32035d95e5563ead9d54d8ef810c20913da702d983a23c66fc51e9f00647556bee2ba48803bd13b1340744c78aaea835bb9c247e616480595043de9566a
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-