General
-
Target
3785de6fea9dd482f50e6f0d0431fddd762f48611205b9e662dffd8b26af21b1
-
Size
540KB
-
Sample
220625-22egvsffak
-
MD5
abc674c09d5dda3d84c42f98bb1bbb40
-
SHA1
109a78248d4e49b5fe2def7e5c808da095e3482e
-
SHA256
3785de6fea9dd482f50e6f0d0431fddd762f48611205b9e662dffd8b26af21b1
-
SHA512
c0118188646b80c6a07df1a1b7e748dd5347884b9102519eb7e29927ffa120c628fb9f6f1745d1324006c2e72e7dd21a4748b6b26c4656b1e468d7412f67ac16
Static task
static1
Behavioral task
behavioral1
Sample
3785de6fea9dd482f50e6f0d0431fddd762f48611205b9e662dffd8b26af21b1.exe
Resource
win7-20220414-en
Malware Config
Extracted
trickbot
1000474
jim575
51.68.247.62:443
37.228.117.146:443
91.132.139.170:443
37.44.212.216:443
31.184.253.37:443
51.254.69.244:443
194.5.250.82:443
5.230.22.40:443
185.222.202.222:443
46.30.41.229:443
203.23.128.168:443
190.154.203.218:449
189.80.134.122:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
146.196.122.167:449
177.103.240.149:449
181.199.102.179:449
200.21.51.38:449
181.49.61.237:449
190.152.4.210:449
138.59.233.5:449
36.89.85.103:449
45.161.33.88:449
186.42.185.10:449
170.233.120.53:449
187.110.100.122:449
200.153.15.178:449
186.42.98.254:449
181.129.93.226:449
186.42.226.46:449
190.13.160.19:449
186.183.199.114:449
170.84.78.117:449
190.152.4.98:449
181.196.61.110:449
138.185.25.228:449
200.35.56.81:449
186.42.186.202:449
185.70.182.162:449
91.207.185.73:449
181.129.49.98:449
181.115.168.69:449
-
autorunControl:GetSystemInfoName:systeminfoName:pwgrab
Targets
-
-
Target
3785de6fea9dd482f50e6f0d0431fddd762f48611205b9e662dffd8b26af21b1
-
Size
540KB
-
MD5
abc674c09d5dda3d84c42f98bb1bbb40
-
SHA1
109a78248d4e49b5fe2def7e5c808da095e3482e
-
SHA256
3785de6fea9dd482f50e6f0d0431fddd762f48611205b9e662dffd8b26af21b1
-
SHA512
c0118188646b80c6a07df1a1b7e748dd5347884b9102519eb7e29927ffa120c628fb9f6f1745d1324006c2e72e7dd21a4748b6b26c4656b1e468d7412f67ac16
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-