Resubmissions

17-01-2021 17:46

210117-3136fl8fba 10

17-01-2021 17:07

210117-hja3svw3ca 10

16-01-2021 12:09

210116-yfbgweax36 10

16-01-2021 07:28

210116-bpcv3fv8fn 10

General

  • Target

    b5ef0dd86a3fb068a1eef951a9e9bcd1.exe

  • Size

    630KB

  • Sample

    210116-bpcv3fv8fn

  • MD5

    b5ef0dd86a3fb068a1eef951a9e9bcd1

  • SHA1

    098e8b092629f8b1ab59d20b4ebbe39725b2064b

  • SHA256

    b6af20ac6ddedad4f914bcb11c08e5399a4aadade16365bae3a5cb1611371e89

  • SHA512

    45b1477ba4900eaae9731a5f182ff566ba1b9c023db5a0a251779956ea6c2167a4175c182d977b210ec056233237c31981a32593e089ac97418d656678e8fb73

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob38

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      b5ef0dd86a3fb068a1eef951a9e9bcd1.exe

    • Size

      630KB

    • MD5

      b5ef0dd86a3fb068a1eef951a9e9bcd1

    • SHA1

      098e8b092629f8b1ab59d20b4ebbe39725b2064b

    • SHA256

      b6af20ac6ddedad4f914bcb11c08e5399a4aadade16365bae3a5cb1611371e89

    • SHA512

      45b1477ba4900eaae9731a5f182ff566ba1b9c023db5a0a251779956ea6c2167a4175c182d977b210ec056233237c31981a32593e089ac97418d656678e8fb73

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks