Overview

overview

10

Static

static

32-422-76....xe.dll

windows7_x64

10

32-422-76....xe.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32-422-76.assp.exe

  • Size

    356KB

  • Sample

    210201-j6famvveyx

  • MD5

    51177b8eba011e530083443352d5eff9

  • SHA1

    b9ba834dd1ab9d5951ea7559ad1565a7f2eb6641

  • SHA256

    948d8e5898e3b97498e0b536c416d6532690c71e4a2e39f97dd5bf64e588d573

  • SHA512

    4a10729c2334a6c97ccc74ca87960ec09702483fea83975e20166fc0149d25b30204f5297382b5cbb9a9123f9c8c1b26ed9ca4f11efd115eda1d5c4dbab70197

Score
10/10
trickbotrob44bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob44

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      32-422-76.assp.exe

    • Size

      356KB

    • MD5

      51177b8eba011e530083443352d5eff9

    • SHA1

      b9ba834dd1ab9d5951ea7559ad1565a7f2eb6641

    • SHA256

      948d8e5898e3b97498e0b536c416d6532690c71e4a2e39f97dd5bf64e588d573

    • SHA512

      4a10729c2334a6c97ccc74ca87960ec09702483fea83975e20166fc0149d25b30204f5297382b5cbb9a9123f9c8c1b26ed9ca4f11efd115eda1d5c4dbab70197

    Score
    10/10
    trickbotrob44bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Templ.dll packer

      Detects Templ.dll packer which usually loads Trickbot.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks