General
-
Target
Document_98986.xlsb
-
Size
83KB
-
Sample
210201-dy3xn55nzx
-
MD5
f81a8b223287fab66b71b7dc6436081a
-
SHA1
aeb8a82c28fc6033782aa1f1073f49dc69123c54
-
SHA256
c4d78b3059d228b9255b76e7cd8d9b2d2545c76d29f68728c2ca530011c0f0e1
-
SHA512
45d5202c79e2bfdd7198fdbc7a51adc455e9af6e19115ffddf33c4fe55dd172485ac340205ee107af82995e7ab42b51309031e692e01cf4c5023149fa4f807e0
Malware Config
Extracted
trickbot
100010
mon39
5.34.180.180:443
64.74.160.228:443
198.46.198.116:443
5.34.180.185:443
107.152.46.188:443
195.123.241.214:443
23.254.224.2:443
107.172.188.113:443
200.52.147.93:443
185.198.59.45:443
45.14.226.101:443
185.82.126.38:443
85.204.116.139:443
45.155.173.248:443
103.91.244.50:443
45.230.244.20:443
45.226.124.226:443
187.84.95.6:443
186.250.157.116:443
186.137.85.76:443
-
autorunName:pwgrab
Targets
-
-
Target
Document_98986.xlsb
-
Size
83KB
-
MD5
f81a8b223287fab66b71b7dc6436081a
-
SHA1
aeb8a82c28fc6033782aa1f1073f49dc69123c54
-
SHA256
c4d78b3059d228b9255b76e7cd8d9b2d2545c76d29f68728c2ca530011c0f0e1
-
SHA512
45d5202c79e2bfdd7198fdbc7a51adc455e9af6e19115ffddf33c4fe55dd172485ac340205ee107af82995e7ab42b51309031e692e01cf4c5023149fa4f807e0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-