General
-
Target
boom5.dll
-
Size
336KB
-
Sample
210122-2crthmaw2s
-
MD5
a4193551194e8ca981319f06cd2231d2
-
SHA1
1f07b147da7d6a01979652aaefe6fd60a01af0d2
-
SHA256
3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991
-
SHA512
7d844ad401e8307613b2ac2dd0c0594fd25fc6b676d0214119a95bea28fbafb3c1fb0c62594f1026dda3825daee1a4b60e5ee52c63e11e25e25390da8b27102a
Static task
static1
Behavioral task
behavioral1
Sample
boom5.dll
Resource
win7v20201028
Malware Config
Extracted
trickbot
100007
boom5
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
-
autorunName:pwgrab
Targets
-
-
Target
boom5.dll
-
Size
336KB
-
MD5
a4193551194e8ca981319f06cd2231d2
-
SHA1
1f07b147da7d6a01979652aaefe6fd60a01af0d2
-
SHA256
3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991
-
SHA512
7d844ad401e8307613b2ac2dd0c0594fd25fc6b676d0214119a95bea28fbafb3c1fb0c62594f1026dda3825daee1a4b60e5ee52c63e11e25e25390da8b27102a
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-