c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.zip

General
Target

c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.zip

Size

306KB

Sample

210504-swwvx8pf5n

Score
10 /10
MD5

d379426800655513192e568a2fc622cc

SHA1

0fb3e0593c4cdaa16e268c14b8af10c48adf88e7

SHA256

9bb74e2a1b3925184140f5a771b1e4638dfb5c61941bbc0b52809b3ca76b4887

SHA512

889617091b8362284422e6bc75c219c18ac7b024755919b145cd78989194af8d5992f1825d982426679eb9a9c4c3a913819945d1a2407568a62b0980d8f1ccb5

Malware Config

Extracted

Family trickbot
Version 2000029
Botnet net9
C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443

Attributes
autorun
Name: pwgrabb
Name: pwgrabc
ecc_pubkey.base64
Targets
Target

c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240.dll

MD5

eb70b6c24c0466954169882dbe5729a4

Filesize

433KB

Score
10 /10
SHA1

b81bcd8273854efb7d7b3fb5b982d75051a5d9a6

SHA256

c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240

SHA512

e90c5c958024734f089205e43f2c9a842e4fc68b8a7fcc7fc10754511a8b6bb724eab563bdd5141f9a1be634a3194f5b3abd14f97cdd0735c42f501d8f63e59f

Tags

Signatures

  • Trickbot

    Description

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    Tags

  • Templ.dll packer

    Description

    Detects Templ.dll packer which usually loads Trickbot.

  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Tasks

                          static1

                          behavioral1

                          10/10

                          behavioral2

                          10/10