General
-
Target
SecuriteInfo.com.Trojan.Packed.140.27461.4957
-
Size
424KB
-
Sample
210106-l3jrl5btda
-
MD5
85843f6bce45e73ae01407f2408e279d
-
SHA1
5a75c6b27a83fdca3c08778425c6f5839f163054
-
SHA256
00d7094d9bd9a252a25c9324a767b9f5d34eba8ba0a4582f39d7d988627f0c40
-
SHA512
54af7e96f8ead2c6f941bd4930819e93fd52c333f66763a076a5460a33158a6eaf8d17a861c7c79a96a06cd2b42470c840be68ce3c57cfec5b676db1a5ff04b8
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Packed.140.27461.4957.exe
Resource
win7v20201028
Malware Config
Extracted
trickbot
100009
lib5
149.54.11.54:449
36.89.191.119:449
41.159.31.227:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.44:449
194.5.249.143:443
142.202.191.175:443
195.123.241.31:443
45.89.125.214:443
45.83.151.103:443
91.200.103.41:443
66.70.246.0:443
64.74.160.218:443
198.46.198.115:443
5.34.180.173:443
23.227.196.5:443
195.123.241.115:443
107.152.42.163:443
-
autorunName:pwgrab
Targets
-
-
Target
SecuriteInfo.com.Trojan.Packed.140.27461.4957
-
Size
424KB
-
MD5
85843f6bce45e73ae01407f2408e279d
-
SHA1
5a75c6b27a83fdca3c08778425c6f5839f163054
-
SHA256
00d7094d9bd9a252a25c9324a767b9f5d34eba8ba0a4582f39d7d988627f0c40
-
SHA512
54af7e96f8ead2c6f941bd4930819e93fd52c333f66763a076a5460a33158a6eaf8d17a861c7c79a96a06cd2b42470c840be68ce3c57cfec5b676db1a5ff04b8
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-