Overview

overview

10

Static

static

10

rundll32_03300000.dll

windows7_x64

10

rundll32_03300000.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rundll32_03300000.dll

  • Size

    208KB

  • MD5

    4098b34beea650657077c34cccc64d23

  • SHA1

    9d530cc1702acef7bfc366c81746b77fa0d47f71

  • SHA256

    80afc885cde130c0fcc5e8b7e0a03130ca7922790ba82853c8ec1de8cb951f83

  • SHA512

    0be883596c4cecc29304daffce9538f3c59b235bf4501aecb53a239c4251da210d0f05a3f537131af6993302903d9b48d741b4af773f80d4bfeeca9cc4580fd9

Score
10/10
rob52trickbot

Malware Config

Extracted

Family

trickbot

Version

2000028

Botnet

rob52

C2

89.250.208.42:449

182.253.184.130:449

31.211.85.110:443

85.112.74.178:449

102.68.17.97:443

103.76.150.14:443

96.9.77.142:443

91.185.236.170:449

87.76.1.81:449

91.225.231.120:443

62.213.14.166:443

81.95.45.234:449

148.216.32.55:443

109.185.139.90:449

202.166.211.197:443

196.41.57.46:449

84.21.206.164:449

190.122.168.219:443

77.95.93.132:449

41.77.134.250:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Signatures

  • Trickbot family
    trickbot
  • Templ.dll packer 1 IoCs

    Detects Templ.dll packer which usually loads Trickbot.

Files

  • rundll32_03300000.dll
    .dll windows x86 regsvr32


    Exports