General

  • Target

    TrickBot_may_4_2021_04C10000.bin

  • Size

    204KB

  • Sample

    210504-k9m7hy7r3a

  • MD5

    8989fb6ccf22d21d5aea6a28075acd98

  • SHA1

    f5b06d3784e6b03762efdbfd99ff81651314174a

  • SHA256

    4ac8dd3d3be4961e16042fee5ea25764cbeb8acacb121fa62d1101df4006d9e7

  • SHA512

    75c6152a4226fc88d31a6e8454c1f02ff0023e08dc59bf7751d9c033829ca1df505eb13a6f893f636201d41ac1b0dac3a63a5e11ba3854a1e4bc979e86fd94a0

Malware Config

Extracted

Family

trickbot

Version

2000029

Botnet

net9

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      TrickBot_may_4_2021_04C10000.bin

    • Size

      204KB

    • MD5

      8989fb6ccf22d21d5aea6a28075acd98

    • SHA1

      f5b06d3784e6b03762efdbfd99ff81651314174a

    • SHA256

      4ac8dd3d3be4961e16042fee5ea25764cbeb8acacb121fa62d1101df4006d9e7

    • SHA512

      75c6152a4226fc88d31a6e8454c1f02ff0023e08dc59bf7751d9c033829ca1df505eb13a6f893f636201d41ac1b0dac3a63a5e11ba3854a1e4bc979e86fd94a0

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks