General
-
Target
SpreadSheets.exe
-
Size
692KB
-
Sample
210118-jdmj7bksra
-
MD5
0c5031a6dba992845a442e5e901fd439
-
SHA1
9f03c6d6182d9255a4acc96a68a578e3ca9ca17d
-
SHA256
63b91b66c7d71763867ce4333d503db7d46901d16f3e971d63498c89046e6a75
-
SHA512
00a9b75038dce549ec69cb517cce4332ebcf62b83e7522cf5c99d875f6d1e4c10d4bc36c7b6d48b842ff6a8ae7b0379881e55fc35747a4468a2a7c21b644d879
Malware Config
Extracted
trickbot
100009
tot6
149.54.11.54:449
36.89.191.119:449
41.159.31.227:449
103.150.68.124:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.44:449
194.5.249.143:443
142.202.191.175:443
195.123.241.31:443
45.89.125.214:443
45.83.151.103:443
91.200.103.41:443
66.70.246.0:443
64.74.160.218:443
198.46.198.115:443
5.34.180.173:443
23.227.196.5:443
195.123.241.115:443
-
autorunName:pwgrab
Targets
-
-
Target
SpreadSheets.exe
-
Size
692KB
-
MD5
0c5031a6dba992845a442e5e901fd439
-
SHA1
9f03c6d6182d9255a4acc96a68a578e3ca9ca17d
-
SHA256
63b91b66c7d71763867ce4333d503db7d46901d16f3e971d63498c89046e6a75
-
SHA512
00a9b75038dce549ec69cb517cce4332ebcf62b83e7522cf5c99d875f6d1e4c10d4bc36c7b6d48b842ff6a8ae7b0379881e55fc35747a4468a2a7c21b644d879
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-