Overview

overview

10

Static

static

c6fcd45cbf...15.dll

windows7_x64

10

c6fcd45cbf...15.dll

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    c6fcd45cbffe733beab01bd9d7706615
  • Size 528KB
  • Sample210611-3qb2ccxqcs
  • SHA256 896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a
  • MD5 SHA1 SHA512
Score
10/10
trickbotsat1bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 100017

Botnet

  • sat1

C2

  • 178.72.192.20:443

  • 103.124.145.98:443

  • 45.5.152.39:443

  • 114.7.240.222:443

  • 85.248.1.126:443

  • 94.183.237.101:443

  • 146.196.121.219:443

  • 89.37.1.2:443

  • 94.142.179.77:443

  • 177.221.39.161:443

  • 85.175.171.246:443

  • 103.12.160.164:443

  • 180.178.106.50:443

  • 94.142.179.179:443

  • 46.209.140.220:443

  • 123.231.149.122:443

  • 123.231.149.123:443

  • 182.160.116.190:443

  • 131.0.112.122:443

  • 116.0.6.110:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target
      c6fcd45cbffe733beab01bd9d7706615
    • Size 528KB
    • SHA256 896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbotsat1bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks