Overview

overview

10

Static

static

7f016a0508...40.exe

windows7_x64

10

7f016a0508...40.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f016a05085c5be23a43aa0f2bc7acbf2e0f0bb9ee778c3c3c747f1d5a319640

  • Size

    560KB

  • Sample

    210506-zce546eyya

  • MD5

    b155aa085f43e5ad15968fd0840f62e6

  • SHA1

    c330a1e74870a3481dc780604abf57ef2afc7ad3

  • SHA256

    7f016a05085c5be23a43aa0f2bc7acbf2e0f0bb9ee778c3c3c747f1d5a319640

  • SHA512

    d5c4c9689250cedeadf70f03a31998c14271d44f44510411621a89bf4ff16e053a92f46941dfb57c5841bb19e3c7ee3b688726f1df95bd9509a29a7096752003

Score
10/10
trickbotono23bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000480

Botnet

ono23

C2

144.91.79.9:443

172.245.97.148:443

85.204.116.139:443

185.62.188.117:443

185.222.202.76:443

144.91.79.12:443

185.68.93.43:443

195.123.238.191:443

146.185.219.29:443

195.133.196.151:443

91.235.129.60:443

23.227.206.170:443

185.222.202.192:443

190.154.203.218:449

178.183.150.169:449

200.116.199.10:449

187.58.56.26:449

177.103.240.149:449

81.190.160.139:449

200.21.51.38:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      7f016a05085c5be23a43aa0f2bc7acbf2e0f0bb9ee778c3c3c747f1d5a319640

    • Size

      560KB

    • MD5

      b155aa085f43e5ad15968fd0840f62e6

    • SHA1

      c330a1e74870a3481dc780604abf57ef2afc7ad3

    • SHA256

      7f016a05085c5be23a43aa0f2bc7acbf2e0f0bb9ee778c3c3c747f1d5a319640

    • SHA512

      d5c4c9689250cedeadf70f03a31998c14271d44f44510411621a89bf4ff16e053a92f46941dfb57c5841bb19e3c7ee3b688726f1df95bd9509a29a7096752003

    Score
    10/10
    trickbotono23bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks