General

  • Target

    e4000f99688711a204c39edb48a1eee3.exe

  • Size

    815KB

  • Sample

    210303-rqgbtvl2rs

  • MD5

    e4000f99688711a204c39edb48a1eee3

  • SHA1

    2c1db78bb0bc62cd0f441c72b3316e249eb80154

  • SHA256

    c0be0f25fb70e23fd5793d2f913462288927300e377d6cc297402a9490fd00b4

  • SHA512

    f59a0a5027602d5dc000f71514452a06244c5420823a72b3b90ceb9bc7de7574fa3bc7b753b24dab171b3a83dbcea2179c7f40f8ee0d581f526e943a82325b64

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob35

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      e4000f99688711a204c39edb48a1eee3.exe

    • Size

      815KB

    • MD5

      e4000f99688711a204c39edb48a1eee3

    • SHA1

      2c1db78bb0bc62cd0f441c72b3316e249eb80154

    • SHA256

      c0be0f25fb70e23fd5793d2f913462288927300e377d6cc297402a9490fd00b4

    • SHA512

      f59a0a5027602d5dc000f71514452a06244c5420823a72b3b90ceb9bc7de7574fa3bc7b753b24dab171b3a83dbcea2179c7f40f8ee0d581f526e943a82325b64

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Blocklisted process makes network request

MITRE ATT&CK Matrix

Tasks