trickbot | e2d56541f7cd88f71d230201599d6210982ca303da9ba53f055404afda2ccf2e | Triage

Sharing

General

Target

e2d56541f7cd88f71d230201599d6210982ca303da9ba53f055404afda2ccf2e
Size

356KB
Sample

210924-kasrqsgchr
MD5

62c59fcf96cc57df10961afcbeb739db
SHA1

7f8169d534ef2ba3a34921fc4b86fd64abaaf7ae
SHA256

e2d56541f7cd88f71d230201599d6210982ca303da9ba53f055404afda2ccf2e
SHA512

e0a40030d7bdf1e7053728d620c894aa1c573bfadfd02cd6cfc56fbbda13082694e7f852eb2aa47099ce056b0344e36ccefc151b74f5ad08d9b166c2f0bbff17

Score

10^/10

trickbot lip124 banker suricata trojan

Malware Config

Extracted

Family

trickbot

Version

100019

Botnet

lip124

C2

65.152.201.203:443

185.56.175.122:443

46.99.175.217:443

179.189.229.254:443

46.99.175.149:443

181.129.167.82:443

216.166.148.187:443

46.99.188.223:443

128.201.76.252:443

62.99.79.77:443

60.51.47.65:443

24.162.214.166:443

45.36.99.184:443

97.83.40.67:443

184.74.99.214:443

103.105.254.17:443

62.99.76.213:443

82.159.149.52:443

Attributes

autorun
Name:pwgrabb
Name:pwgrabc

ecc_pubkey.base64

Targets

- Target
  
  e2d56541f7cd88f71d230201599d6210982ca303da9ba53f055404afda2ccf2e
- Size
  
  356KB
- MD5
  
  62c59fcf96cc57df10961afcbeb739db
- SHA1
  
  7f8169d534ef2ba3a34921fc4b86fd64abaaf7ae
- SHA256
  
  e2d56541f7cd88f71d230201599d6210982ca303da9ba53f055404afda2ccf2e
- SHA512
  
  e0a40030d7bdf1e7053728d620c894aa1c573bfadfd02cd6cfc56fbbda13082694e7f852eb2aa47099ce056b0344e36ccefc151b74f5ad08d9b166c2f0bbff17
Score

10^/10

trickbot lip124 banker suricata trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
  suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
  suricata
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

trickbotlip124bankersuricatatrojan