Overview

overview

10

Static

static

c28522e02d...b9.exe

windows7_x64

10

c28522e02d...b9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9

  • Size

    881KB

  • Sample

    220128-xmlv6sbch8

  • MD5

    59ccde8ff080314a8568b0f909037ca2

  • SHA1

    acf6ab5b9a983c70864f0c95790d85d257ceb528

  • SHA256

    c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9

  • SHA512

    6f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2

Score
10/10
trickbottrgt98888bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000479

Botnet

trgt98888

C2

192.3.104.46:443

23.94.233.210:443

172.82.152.126:443

192.3.247.11:443

202.29.215.114:449
Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9

    • Size

      881KB

    • MD5

      59ccde8ff080314a8568b0f909037ca2

    • SHA1

      acf6ab5b9a983c70864f0c95790d85d257ceb528

    • SHA256

      c28522e02d279c2fdb47d79b98976d2cf63347121dbbb467e12ce0eafb4369b9

    • SHA512

      6f5b69bf9ba0d987c998fca02f1a572147c850085764334971310a9d05378eb40bd85eb7cb49d9863f3b6101716a5d3c69e7a23292b653a92a9f107c2aace9a2

    Score
    10/10
    trickbottrgt98888bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks