General

  • Target

    37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

  • Size

    328KB

  • Sample

    220626-asz9escba2

  • MD5

    0eba374e54412c66d6e63efe31c6446a

  • SHA1

    4b44576383a558237f931faf7483fe5ae3450ccf

  • SHA256

    37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

  • SHA512

    90232674cf45466775a017552fd1074e64820c210b845ae950d758c214c0d3c3aeedbb773367f05ff15c88b4a221aad0e138b07aa13ab6582d1c23b49e40aefb

Malware Config

Extracted

Family

trickbot

Version

1000474

Botnet

win165

C2

51.68.247.62:443

37.228.117.146:443

91.132.139.170:443

37.44.212.216:443

31.184.253.37:443

51.254.69.244:443

194.5.250.82:443

5.230.22.40:443

185.222.202.222:443

46.30.41.229:443

203.23.128.168:443

190.154.203.218:449

189.80.134.122:449

200.116.199.10:449

181.113.20.186:449

187.58.56.26:449

146.196.122.167:449

177.103.240.149:449

181.199.102.179:449

200.21.51.38:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

    • Size

      328KB

    • MD5

      0eba374e54412c66d6e63efe31c6446a

    • SHA1

      4b44576383a558237f931faf7483fe5ae3450ccf

    • SHA256

      37166c1a0dd8d880184e70d62b0ad98c89d499092b6d7eea67e778f1ea17f935

    • SHA512

      90232674cf45466775a017552fd1074e64820c210b845ae950d758c214c0d3c3aeedbb773367f05ff15c88b4a221aad0e138b07aa13ab6582d1c23b49e40aefb

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks