Overview

overview

10

Static

static

lovemetertok.png.dll

windows7_x64

10

lovemetertok.png.dll

windows10_x64

10

Resubmissions

19-08-2021 15:16

210819-h98ahcyb92 10

20-07-2021 18:47

210720-acfs94mz4j 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lovemetertok.png

  • Size

    544KB

  • Sample

    210720-acfs94mz4j

  • MD5

    712c24363a47abc4d4c63e38121d48b6

  • SHA1

    f41df626fe1b067dc6cf6cfe99a632c2ee6f1c66

  • SHA256

    dafc058d57b736297e2e8c5126a3a4310e007c32cdaecdbe5af8e8eca05f33ed

  • SHA512

    c31ca1fc8cd749bc3d84c63ce63d9793a5f29f36283ad2c0fa7c899bad178cc7265b337eb51dbae739dd688a23cb3905fa5f9918a6ceb592d088d99f34d2cb6a

Score
10/10
trickbotrob109bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

rob109

C2

38.110.103.124:443

185.56.76.28:443

204.138.26.60:443

60.51.47.65:443

74.85.157.139:443

68.69.26.182:443

38.110.103.136:443

38.110.103.18:443

138.34.28.219:443

185.56.76.94:443

217.115.240.248:443

24.162.214.166:443

80.15.2.105:443

154.58.23.192:443

38.110.100.104:443

45.36.99.184:443

185.56.76.108:443

185.56.76.72:443

138.34.28.35:443

97.83.40.67:443
Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      lovemetertok.png

    • Size

      544KB

    • MD5

      712c24363a47abc4d4c63e38121d48b6

    • SHA1

      f41df626fe1b067dc6cf6cfe99a632c2ee6f1c66

    • SHA256

      dafc058d57b736297e2e8c5126a3a4310e007c32cdaecdbe5af8e8eca05f33ed

    • SHA512

      c31ca1fc8cd749bc3d84c63ce63d9793a5f29f36283ad2c0fa7c899bad178cc7265b337eb51dbae739dd688a23cb3905fa5f9918a6ceb592d088d99f34d2cb6a

    Score
    10/10
    trickbotrob109bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks