General

  • Target

    a0fec658914a5ee9c34a377a551bc55a.exe

  • Size

    918KB

  • Sample

    210113-smqxnqdeej

  • MD5

    a0fec658914a5ee9c34a377a551bc55a

  • SHA1

    eb87d5aeb825225f92631f6d6bbf1da899a31646

  • SHA256

    93eff848f8e6c75ebecd7ce955bb20fb9d267d765861de804730ad6030db0f9c

  • SHA512

    24367b6635a692e1f64a8f8da8f3be94cda4352ad337fc71dddcbb52b8859626cf000b6b89545c375e05d858b0ea87be68d4b2e0ce0779c59b5e79eb896814b4

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob35

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      a0fec658914a5ee9c34a377a551bc55a.exe

    • Size

      918KB

    • MD5

      a0fec658914a5ee9c34a377a551bc55a

    • SHA1

      eb87d5aeb825225f92631f6d6bbf1da899a31646

    • SHA256

      93eff848f8e6c75ebecd7ce955bb20fb9d267d765861de804730ad6030db0f9c

    • SHA512

      24367b6635a692e1f64a8f8da8f3be94cda4352ad337fc71dddcbb52b8859626cf000b6b89545c375e05d858b0ea87be68d4b2e0ce0779c59b5e79eb896814b4

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks