General
-
Target
3bd37a0d6936e911850beb6d22f06b19.exe
-
Size
356KB
-
Sample
210924-kpw3psgddp
-
MD5
3bd37a0d6936e911850beb6d22f06b19
-
SHA1
fa11a7585f5255447e6b3f5dfc2d78d6d6a22605
-
SHA256
9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3
-
SHA512
9c0a070c2c66f08eaf4f1ae674951d795a43b438c8532b4121ab217f475ef5749e0f0ab4ae3ab1ca2f8dcd86cbf0ca750930de14eb2cb0cc8dc4a0d2a3da569e
Malware Config
Extracted
trickbot
100019
lip124
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
-
autorunName:pwgrabbName:pwgrabc
Targets
-
-
Target
3bd37a0d6936e911850beb6d22f06b19.exe
-
Size
356KB
-
MD5
3bd37a0d6936e911850beb6d22f06b19
-
SHA1
fa11a7585f5255447e6b3f5dfc2d78d6d6a22605
-
SHA256
9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3
-
SHA512
9c0a070c2c66f08eaf4f1ae674951d795a43b438c8532b4121ab217f475ef5749e0f0ab4ae3ab1ca2f8dcd86cbf0ca750930de14eb2cb0cc8dc4a0d2a3da569e
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-