General

  • Target

    wGGlWA9kvQ.js

  • Size

    30KB

  • Sample

    210113-p2mvq8dacn

  • MD5

    71e84623c9f780a2ae34c49964a1d4fd

  • SHA1

    8bab366961bf4363c13b169f086c959ff8515e85

  • SHA256

    4bdc0f495dfb6d2425fd712ccdda2d1943c700e3b780c37c1c147462a30c9e30

  • SHA512

    f4cd7ccd1bf213e3262e4268b0247466b31e3bed3b3877a54b24e58d6710b6f1e83dce581d6d88ab544382cd6559fca2955e83657fd7801d0852fd00497327eb

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://dralex.smartwebsitedesign.com/local.php

Extracted

Family

trickbot

Version

100010

Botnet

rob35

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      wGGlWA9kvQ.js

    • Size

      30KB

    • MD5

      71e84623c9f780a2ae34c49964a1d4fd

    • SHA1

      8bab366961bf4363c13b169f086c959ff8515e85

    • SHA256

      4bdc0f495dfb6d2425fd712ccdda2d1943c700e3b780c37c1c147462a30c9e30

    • SHA512

      f4cd7ccd1bf213e3262e4268b0247466b31e3bed3b3877a54b24e58d6710b6f1e83dce581d6d88ab544382cd6559fca2955e83657fd7801d0852fd00497327eb

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Blocklisted process makes network request

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks