General
-
Target
3b9c6021ac6a2d0a194851ab815d0c7d2d690acd51ac826142644a2d78ba88a1
-
Size
620KB
-
Sample
220703-l9mv7shac9
-
MD5
c1823f10c2540a557d85bb9ae73a148e
-
SHA1
36a288be0acf1d50a4602ee99ab1df113b40bb9c
-
SHA256
3b9c6021ac6a2d0a194851ab815d0c7d2d690acd51ac826142644a2d78ba88a1
-
SHA512
19a81cbd69c002f56a884fd0dad7299d3bf49f3c45770e36c9f0345a49ba69f142e0378bb4d5881040f5daa348e1988dc1d02502394710352ace670735450b81
Static task
static1
Behavioral task
behavioral1
Sample
3b9c6021ac6a2d0a194851ab815d0c7d2d690acd51ac826142644a2d78ba88a1.exe
Resource
win7-20220414-en
Malware Config
Extracted
trickbot
1000474
kin4
51.68.247.62:443
37.228.117.146:443
91.132.139.170:443
37.44.212.216:443
31.184.253.37:443
51.254.69.244:443
194.5.250.82:443
5.230.22.40:443
185.222.202.222:443
46.30.41.229:443
203.23.128.168:443
190.154.203.218:449
189.80.134.122:449
200.116.199.10:449
181.113.20.186:449
187.58.56.26:449
146.196.122.167:449
177.103.240.149:449
181.199.102.179:449
200.21.51.38:449
181.49.61.237:449
190.152.4.210:449
138.59.233.5:449
36.89.85.103:449
45.161.33.88:449
186.42.185.10:449
170.233.120.53:449
187.110.100.122:449
200.153.15.178:449
186.42.98.254:449
181.129.93.226:449
186.42.226.46:449
190.13.160.19:449
186.183.199.114:449
170.84.78.117:449
190.152.4.98:449
181.196.61.110:449
138.185.25.228:449
200.35.56.81:449
186.42.186.202:449
185.70.182.162:449
91.207.185.73:449
181.129.49.98:449
181.115.168.69:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDllName:pwgrab
Targets
-
-
Target
3b9c6021ac6a2d0a194851ab815d0c7d2d690acd51ac826142644a2d78ba88a1
-
Size
620KB
-
MD5
c1823f10c2540a557d85bb9ae73a148e
-
SHA1
36a288be0acf1d50a4602ee99ab1df113b40bb9c
-
SHA256
3b9c6021ac6a2d0a194851ab815d0c7d2d690acd51ac826142644a2d78ba88a1
-
SHA512
19a81cbd69c002f56a884fd0dad7299d3bf49f3c45770e36c9f0345a49ba69f142e0378bb4d5881040f5daa348e1988dc1d02502394710352ace670735450b81
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-