General

  • Target

    fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

  • Size

    692KB

  • Sample

    210118-xj9wp6wabe

  • MD5

    34da6a5c0f710bb913060171ae73d6b3

  • SHA1

    0a2899b01777fa9f771ae1d58c4953a0659a29d7

  • SHA256

    fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee

  • SHA512

    9a3ae6f2e02e6636f87d5219e12510e57061b42308ad6de6a084f6de0c539eb1b360f2ace1a9d430afac87fe93dab2f2af8cb74d26b6ee674e3f08fa04aa8689

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib6

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee.exe

    • Size

      692KB

    • MD5

      34da6a5c0f710bb913060171ae73d6b3

    • SHA1

      0a2899b01777fa9f771ae1d58c4953a0659a29d7

    • SHA256

      fc42215cfeadafe6b105e6bf26e05451dd2d5627e097f62f135787e2997652ee

    • SHA512

      9a3ae6f2e02e6636f87d5219e12510e57061b42308ad6de6a084f6de0c539eb1b360f2ace1a9d430afac87fe93dab2f2af8cb74d26b6ee674e3f08fa04aa8689

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks