Overview

overview

10

Static

static

b607f8b423...28.exe

windows7_x64

10

b607f8b423...28.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

  • Size

    424KB

  • Sample

    220708-h76zhsfbam

  • MD5

    1a5431b82e0f025a38cd0b680b47997f

  • SHA1

    6b524cd7797ef7d3822dd58f9146ae437d77097c

  • SHA256

    b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

  • SHA512

    c4c9f251a6057c5cc58558ddd60148d869c1ba33a9b036eec7514c93d38fc1663473bdf004591527a3ed7a59ede46b100d7a47b74d7e81359dc99b5a6f123db3

Score
10/10
trickbotlib5bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

    • Size

      424KB

    • MD5

      1a5431b82e0f025a38cd0b680b47997f

    • SHA1

      6b524cd7797ef7d3822dd58f9146ae437d77097c

    • SHA256

      b607f8b423ae8e8bf9d5b8e9dc586ea5476426b1b581cf481e8d627e5e022a28

    • SHA512

      c4c9f251a6057c5cc58558ddd60148d869c1ba33a9b036eec7514c93d38fc1663473bdf004591527a3ed7a59ede46b100d7a47b74d7e81359dc99b5a6f123db3

    Score
    10/10
    trickbotlib5bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks