General
-
Target
SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300
-
Size
424KB
-
Sample
210106-4bjxsqybfj
-
MD5
6087aa8b7ef507c5147453993f1aba51
-
SHA1
009842a189b00f4088a4bae3078b983d15f237cf
-
SHA256
b2d9109a3980aadf1ed5f29d238b63ed62ba1f8bc59649c8becb6e737a3f7540
-
SHA512
a230b18f28c313a7c6e617c516ddcef6ea13061e8b058f709d5f7babcfc468ec3980ec10b46a0f1dd2f07c506bb0ab99dbd0911dfc743ff6d9a202d4747e0b86
Malware Config
Extracted
trickbot
100009
lib5
149.54.11.54:449
36.89.191.119:449
41.159.31.227:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.44:449
194.5.249.143:443
142.202.191.175:443
195.123.241.31:443
45.89.125.214:443
45.83.151.103:443
91.200.103.41:443
66.70.246.0:443
64.74.160.218:443
198.46.198.115:443
5.34.180.173:443
23.227.196.5:443
195.123.241.115:443
-
autorunName:pwgrab
Targets
-
-
Target
SecuriteInfo.com.BehavesLike.Win32.Trickbot.gm.32300
-
Size
424KB
-
MD5
6087aa8b7ef507c5147453993f1aba51
-
SHA1
009842a189b00f4088a4bae3078b983d15f237cf
-
SHA256
b2d9109a3980aadf1ed5f29d238b63ed62ba1f8bc59649c8becb6e737a3f7540
-
SHA512
a230b18f28c313a7c6e617c516ddcef6ea13061e8b058f709d5f7babcfc468ec3980ec10b46a0f1dd2f07c506bb0ab99dbd0911dfc743ff6d9a202d4747e0b86
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-