Overview

overview

10

Static

static

02db3c6b9a...4c.exe

windows7_x64

10

02db3c6b9a...4c.exe

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c

  • Size

    456KB

  • Sample

    220625-dkawcabfdl

  • MD5

    c74656862b16f81d02c109030260245b

  • SHA1

    53b97a9f6b4894d99386a42ab7196d83b719e012

  • SHA256

    02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c

  • SHA512

    ca9283c703e2bbbe2ef6a5291d8460663750a9bb9df41eeecc3bb6fef78db0a0b9a529a68c9b0ccbf288389bc9a42a4f654df4d3e2487bbdd7235ba285123c72

Score
10/10
trickbotyas20bankerdavetrojan

Malware Config

Extracted

Family

trickbot

Version

1000502

Botnet

yas20

C2

5.182.210.226:443

5.182.210.120:443

146.185.253.161:443

194.5.250.136:443

217.12.209.199:443

185.99.2.220:443

192.210.226.106:443

51.254.164.244:443

45.148.120.153:443

5.255.96.119:443

45.142.213.70:443

203.23.128.148:443

195.2.93.50:443

45.93.4.134:443

185.141.27.238:443

93.189.42.66:443

91.235.129.144:443

82.148.16.5:443

190.214.13.2:449

181.140.173.186:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c

    • Size

      456KB

    • MD5

      c74656862b16f81d02c109030260245b

    • SHA1

      53b97a9f6b4894d99386a42ab7196d83b719e012

    • SHA256

      02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c

    • SHA512

      ca9283c703e2bbbe2ef6a5291d8460663750a9bb9df41eeecc3bb6fef78db0a0b9a529a68c9b0ccbf288389bc9a42a4f654df4d3e2487bbdd7235ba285123c72

    Score
    10/10
    trickbotyas20bankerdavetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks