General
-
Target
Attach_1173795677_35048458.xls
-
Size
141KB
-
Sample
210224-jktr9829nj
-
MD5
00aeae3f7461f896f1c2fcf505f7dc05
-
SHA1
6c102b19e8af7234b073f61f5bd21e6cbe655897
-
SHA256
269e90bae09cfe1649937e5dd2763b7136531ca2b6b85963ebd11915e6027dbc
-
SHA512
91d20d053e7094b98c4572cbadcdb6713916f9a9d5f93a2bd61f65381b8becfc5a2205d1a70797ef7c2d4e20ab8cd005806df982a355e4aac2e1936e30062e27
Malware Config
Extracted
http://bearcatpumps.com.cn/css/tolkio.php
Extracted
trickbot
2000026
rob16
154.79.252.132:449
179.191.108.58:449
200.6.169.124:443
103.76.20.226:443
80.78.77.116:449
80.78.75.246:443
45.234.248.66:449
187.190.116.59:443
185.234.72.84:443
36.94.202.131:443
103.91.244.102:449
168.232.188.88:449
103.73.101.98:449
173.81.4.147:449
202.142.151.190:449
118.67.216.238:449
108.170.20.72:443
85.159.214.61:443
36.92.93.5:449
79.122.166.236:449
-
autorunName:pwgrab
Targets
-
-
Target
Attach_1173795677_35048458.xls
-
Size
141KB
-
MD5
00aeae3f7461f896f1c2fcf505f7dc05
-
SHA1
6c102b19e8af7234b073f61f5bd21e6cbe655897
-
SHA256
269e90bae09cfe1649937e5dd2763b7136531ca2b6b85963ebd11915e6027dbc
-
SHA512
91d20d053e7094b98c4572cbadcdb6713916f9a9d5f93a2bd61f65381b8becfc5a2205d1a70797ef7c2d4e20ab8cd005806df982a355e4aac2e1936e30062e27
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Templ.dll packer
Detects Templ.dll packer which usually loads Trickbot.
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-