Resubmissions

18-01-2021 08:58

210118-lndtfkm5ma 10

18-01-2021 08:46

210118-597dxywjlx 10

General

  • Target

    e8749f7d1df1cc445776cf359857b664b5cde213bce655a65dd3109427e4fcc1.exe

  • Size

    835KB

  • Sample

    210118-597dxywjlx

  • MD5

    b77dbb9639819e23e228d0ecb25f6a60

  • SHA1

    34e380337abcc97b1b848f1d2de5aea599af5c7e

  • SHA256

    e8749f7d1df1cc445776cf359857b664b5cde213bce655a65dd3109427e4fcc1

  • SHA512

    a49a8bf8fda1c1812c14f720c42495300090750a720b1057cb0fe6ae6b83744663f128b1f570b57d62044d4a226fb0808cb5e64ec5e145e114f4249829fb5194

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob38

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      e8749f7d1df1cc445776cf359857b664b5cde213bce655a65dd3109427e4fcc1.exe

    • Size

      835KB

    • MD5

      b77dbb9639819e23e228d0ecb25f6a60

    • SHA1

      34e380337abcc97b1b848f1d2de5aea599af5c7e

    • SHA256

      e8749f7d1df1cc445776cf359857b664b5cde213bce655a65dd3109427e4fcc1

    • SHA512

      a49a8bf8fda1c1812c14f720c42495300090750a720b1057cb0fe6ae6b83744663f128b1f570b57d62044d4a226fb0808cb5e64ec5e145e114f4249829fb5194

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks