trickbot

General

Target

0d2cda88052d6a9feb73fd7383fb412f15a854f2af1d997dc1048a48edeeca68
Size

680KB
Sample

210324-qqqplk868s
MD5

9a56fc82eecf183305cd5149c8888765
SHA1

d85a5a7c54bab52186ca9a5017df504fbf49319d
SHA256

0d2cda88052d6a9feb73fd7383fb412f15a854f2af1d997dc1048a48edeeca68
SHA512

ce8268897e37560d023be13f28c4c71e375f0edec5db91521dba759b840b095cf106cc983ac2e3295a02784dd230eae503a9aa7637d0eb36d88a4737961758de

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

100014

Botnet

mon159

C2

68.201.55.46:443

71.42.188.85:443

50.197.243.125:443

70.119.149.64:443

71.66.92.190:443

137.27.148.14:443

156.19.152.218:443

73.103.36.158:443

67.212.241.178:443

65.158.28.70:443

96.88.45.25:443

50.84.233.214:443

73.6.0.166:449

50.75.131.6:443

72.128.158.51:443

104.4.84.130:443

108.161.11.44:443

75.118.158.174:443

67.48.50.58:443

47.51.21.82:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  0d2cda88052d6a9feb73fd7383fb412f15a854f2af1d997dc1048a48edeeca68
- Size
  
  680KB
- MD5
  
  9a56fc82eecf183305cd5149c8888765
- SHA1
  
  d85a5a7c54bab52186ca9a5017df504fbf49319d
- SHA256
  
  0d2cda88052d6a9feb73fd7383fb412f15a854f2af1d997dc1048a48edeeca68
- SHA512
  
  ce8268897e37560d023be13f28c4c71e375f0edec5db91521dba759b840b095cf106cc983ac2e3295a02784dd230eae503a9aa7637d0eb36d88a4737961758de
Score

10^/10

trickbot mon159 banker trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Templ.dll packer
  Detects Templ.dll packer which usually loads Trickbot.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Templ.dll packer

Looks up external IP address via web service

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2