Overview

overview

10

Static

static

details_5613.js

windows7_x64

10

details_5613.js

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    details_5613.zip

  • Size

    369KB

  • Sample

    210726-m7t1lb2e6a

  • MD5

    c5b9589de2780ea30771643a47184f00

  • SHA1

    4968e29cbdcc5af704f92d864f5499efcd1a0616

  • SHA256

    8dfc65192c00aa6d2c13bb997e364ca99af41be3c7a281b5b47a1207d61f0886

  • SHA512

    53454d9bed4632428b69fc6cb2876e90fb544cb59cb2e586fc148f154132a75c7884b4b89c90516430782e307db5247f146749a4c64aeb294f3cd82e178d51a9

Score
10/10
trickbotrob112bankerspywarestealersuricatatrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://netvalleykenya.com/crm.php

Extracted

Family

trickbot

Version

100018

Botnet

rob112

C2

38.110.103.124:443

185.56.76.28:443

204.138.26.60:443

60.51.47.65:443

74.85.157.139:443

68.69.26.182:443

38.110.103.136:443

38.110.103.18:443

138.34.28.219:443

185.56.76.94:443

217.115.240.248:443

24.162.214.166:443

80.15.2.105:443

154.58.23.192:443

38.110.100.104:443

45.36.99.184:443

185.56.76.108:443

185.56.76.72:443

138.34.28.35:443

97.83.40.67:443
Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      details_5613.js

    • Size

      629KB

    • MD5

      13ecfbc54efb87498df12bbb02d054ef

    • SHA1

      c857c59ef9fae1eaf4c3d1f8389586b2bc8ea8c6

    • SHA256

      c91bd39590ae41161fc8d4ae9a453f689512ab90a0cc405d00dc9a50db05ea33

    • SHA512

      5993d9c9343c041162f779196fc7a5fea688c1d922d940ca7adf62e4deb683a6104b4299d89f4c5ab05fc1384e7aeeb4e229ce8aed503baa73982c1b8176992d

    Score
    10/10
    trickbotrob112bankerspywarestealersuricatatrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • suricata: ET MALWARE Trickbot Checkin Response

      suricata

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks