Overview

overview

10

Static

static

20551cbd05...2a.exe

windows7_x64

10

20551cbd05...2a.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a
  • Size 1.0MB
  • Sample220128-1q1ehsedhj
  • SHA256 20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a
  • MD5 SHA1 SHA512
Score
10/10
trickbottrg4488bankertrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000477

Botnet

  • trg4488

C2

  • 37.44.212.148:443

  • 185.65.202.127:443

  • 193.37.212.246:443

  • 193.124.191.243:443

  • 31.148.99.63:443

  • 94.103.91.61:443

  • 203.23.128.179:443

  • 179.43.147.72:443

  • 93.123.73.192:443

  • 51.89.115.120:443

  • 144.91.76.214:443

  • 46.21.153.81:443

  • 194.5.250.98:443

  • 190.154.203.218:449

  • 178.183.150.169:449

  • 200.116.199.10:449

  • 181.113.20.186:449

  • 187.58.56.26:449

  • 85.11.116.194:449

  • 177.103.240.149:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a
    • Size 1.0MB
    • SHA256 20551cbd050c0161c37caf30d6e514013952080e74e0101c15346c81cf8d7f2a
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbottrg4488bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks