General

  • Target

    ec00bdbe605b0e4909795bf55230c24f.exe

  • Size

    424KB

  • Sample

    210106-lg75x9n6ne

  • MD5

    ec00bdbe605b0e4909795bf55230c24f

  • SHA1

    f302942049189a72893bd88d6054f599aaccc164

  • SHA256

    16ffd56ef9d4ad421e6e393d3ae311a2e9c8c768589a8eef3a82eb687c9cb052

  • SHA512

    f022e0938d5ce91718ae28da9490c7781fd6f2a3374b30ef7fd772ad21309e2dee9df94ae7da35d1aad67a0e7865c0f790aaa5c5edb921e99938a01e9375e9a4

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      ec00bdbe605b0e4909795bf55230c24f.exe

    • Size

      424KB

    • MD5

      ec00bdbe605b0e4909795bf55230c24f

    • SHA1

      f302942049189a72893bd88d6054f599aaccc164

    • SHA256

      16ffd56ef9d4ad421e6e393d3ae311a2e9c8c768589a8eef3a82eb687c9cb052

    • SHA512

      f022e0938d5ce91718ae28da9490c7781fd6f2a3374b30ef7fd772ad21309e2dee9df94ae7da35d1aad67a0e7865c0f790aaa5c5edb921e99938a01e9375e9a4

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks