Resubmissions

19-08-2021 15:17

210819-pgrhv4mgks 10

20-07-2021 16:24

210720-n71w797m6n 10

General

  • Target

    32.js

  • Size

    463KB

  • Sample

    210720-n71w797m6n

  • MD5

    8f545d23b3544ed3e79ac481de6d2e35

  • SHA1

    2232a67e54f505fbd1d70ae0e18db1f8ed0b307d

  • SHA256

    97e2a97f378f9af38427493fb965461310ee42dd8d74725223073b8fd0f77e65

  • SHA512

    ef0df34055533efc390798bfe0c3875f0bfb5a975012ff77915e4f64c21e4eaf0abdbdeac4d85c74c73dbac9c6744cf4dbe905dc44d089179969516be804d1be

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://109.248.201.26/lovemetertok.php

Extracted

Family

trickbot

Version

100018

Botnet

rob109

C2

38.110.103.124:443

185.56.76.28:443

204.138.26.60:443

60.51.47.65:443

74.85.157.139:443

68.69.26.182:443

38.110.103.136:443

38.110.103.18:443

138.34.28.219:443

185.56.76.94:443

217.115.240.248:443

24.162.214.166:443

80.15.2.105:443

154.58.23.192:443

38.110.100.104:443

45.36.99.184:443

185.56.76.108:443

185.56.76.72:443

138.34.28.35:443

97.83.40.67:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      32.js

    • Size

      463KB

    • MD5

      8f545d23b3544ed3e79ac481de6d2e35

    • SHA1

      2232a67e54f505fbd1d70ae0e18db1f8ed0b307d

    • SHA256

      97e2a97f378f9af38427493fb965461310ee42dd8d74725223073b8fd0f77e65

    • SHA512

      ef0df34055533efc390798bfe0c3875f0bfb5a975012ff77915e4f64c21e4eaf0abdbdeac4d85c74c73dbac9c6744cf4dbe905dc44d089179969516be804d1be

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks