trickbot

General

Target

c89a67fb02f93f2c35d2a2333b283acff44bce36880df33fe6c7fb3917c8bd47
Size

644KB
Sample

210505-cylnf7wk6x
MD5

3a7631ea661cd90f63d4f09376de6555
SHA1

bddf9b33ca5dcda3c46101cee3e92b4709d118c9
SHA256

c89a67fb02f93f2c35d2a2333b283acff44bce36880df33fe6c7fb3917c8bd47
SHA512

5f446c4b98fdbebff194af586bf9c0ba81517d05f891883c9dea918a52875a921f657838a0fad633ee06a5eeb0ab1ea80fa9382faa63dabd8859cf46ec181935

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

2000029

Botnet

tot94

C2

103.66.72.217:443

117.252.68.211:443

103.124.173.35:443

115.73.211.230:443

117.54.250.246:443

131.0.112.122:443

102.176.221.78:443

181.176.161.143:443

154.79.251.172:443

103.111.199.76:443

103.54.41.193:443

154.79.244.182:443

154.79.245.158:443

139.255.116.42:443

178.254.161.250:443

178.134.47.166:443

158.181.179.229:443

103.90.197.33:443

109.207.165.40:443

178.72.192.20:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Targets

- Target
  
  c89a67fb02f93f2c35d2a2333b283acff44bce36880df33fe6c7fb3917c8bd47
- Size
  
  644KB
- MD5
  
  3a7631ea661cd90f63d4f09376de6555
- SHA1
  
  bddf9b33ca5dcda3c46101cee3e92b4709d118c9
- SHA256
  
  c89a67fb02f93f2c35d2a2333b283acff44bce36880df33fe6c7fb3917c8bd47
- SHA512
  
  5f446c4b98fdbebff194af586bf9c0ba81517d05f891883c9dea918a52875a921f657838a0fad633ee06a5eeb0ab1ea80fa9382faa63dabd8859cf46ec181935
Score

10^/10

trickbot tot94 banker trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Looks up external IP address via web service

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2