General
-
Target
32-422-76.assp.exe
-
Size
356KB
-
Sample
210201-d381s9g1xj
-
MD5
51177b8eba011e530083443352d5eff9
-
SHA1
b9ba834dd1ab9d5951ea7559ad1565a7f2eb6641
-
SHA256
948d8e5898e3b97498e0b536c416d6532690c71e4a2e39f97dd5bf64e588d573
-
SHA512
4a10729c2334a6c97ccc74ca87960ec09702483fea83975e20166fc0149d25b30204f5297382b5cbb9a9123f9c8c1b26ed9ca4f11efd115eda1d5c4dbab70197
Static task
static1
Behavioral task
behavioral1
Sample
32-422-76.assp.exe.dll
Resource
win7v20201028
Malware Config
Extracted
trickbot
100010
rob44
5.34.180.180:443
64.74.160.228:443
198.46.198.116:443
5.34.180.185:443
107.152.46.188:443
195.123.241.214:443
23.254.224.2:443
107.172.188.113:443
200.52.147.93:443
185.198.59.45:443
45.14.226.101:443
185.82.126.38:443
85.204.116.139:443
45.155.173.248:443
103.91.244.50:443
45.230.244.20:443
45.226.124.226:443
187.84.95.6:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
180.92.158.244:443
-
autorunName:pwgrab
Targets
-
-
Target
32-422-76.assp.exe
-
Size
356KB
-
MD5
51177b8eba011e530083443352d5eff9
-
SHA1
b9ba834dd1ab9d5951ea7559ad1565a7f2eb6641
-
SHA256
948d8e5898e3b97498e0b536c416d6532690c71e4a2e39f97dd5bf64e588d573
-
SHA512
4a10729c2334a6c97ccc74ca87960ec09702483fea83975e20166fc0149d25b30204f5297382b5cbb9a9123f9c8c1b26ed9ca4f11efd115eda1d5c4dbab70197
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-