Overview

overview

10

Static

static

aa8d1ceba7...71.exe

windows7_x64

10

aa8d1ceba7...71.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

  • Size

    424KB

  • Sample

    220625-hfkxzahgcr

  • MD5

    a28604cbd7a845fe3bae400f76ae4046

  • SHA1

    2bb828db31142a0d03b1f646375b688e130f6ee0

  • SHA256

    aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

  • SHA512

    804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

Score
10/10
trickbotwmd38bankerdavetrojan

Malware Config

Extracted

Family

trickbot

Version

1000498

Botnet

wmd38

C2

5.182.210.226:443

82.146.62.52:443

164.68.120.56:443

185.11.146.86:443

5.2.78.70:443

185.65.202.240:443

193.26.217.243:443

81.177.180.254:443

5.34.177.40:443

185.186.77.222:443

188.227.84.209:443

185.45.193.76:443

46.229.213.27:443

88.99.112.87:443

51.254.164.240:443

45.148.120.13:443

5.2.78.77:443

64.44.51.125:443

107.172.165.149:443

45.148.120.14:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

    • Size

      424KB

    • MD5

      a28604cbd7a845fe3bae400f76ae4046

    • SHA1

      2bb828db31142a0d03b1f646375b688e130f6ee0

    • SHA256

      aa8d1ceba7e76e1af37d400b6906091e81d9bf4969cd010a3a739a35b0e03c71

    • SHA512

      804e9d6076cc6cb886cb529897ec7c38314d658463ccc6567c0af7fbed61d2df770baf18886432b0e95c89fe0408b8816023a89a874630098190170f3de0f655

    Score
    10/10
    trickbotwmd38bankerdavetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks