General

  • Target

    862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944

  • Size

    424KB

  • Sample

    220708-wqarmsgab8

  • MD5

    bc67b9a2dae4bdaad9b1f1fcc2910606

  • SHA1

    bcd589601dea9c11d77e032a8731ab358f042a12

  • SHA256

    862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944

  • SHA512

    99b2f95045260fd8edc4b142962d0e8ac95b69725e1f63944af12337f84f44e532f66d32b4260ca55e5ccdff1e942aef4642cc3215f8b0bfc63e0ba8495b5eb1

Malware Config

Extracted

Family

trickbot

Version

100009

Botnet

lib5

C2

149.54.11.54:449

36.89.191.119:449

41.159.31.227:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.44:449

194.5.249.143:443

142.202.191.175:443

195.123.241.31:443

45.89.125.214:443

45.83.151.103:443

91.200.103.41:443

66.70.246.0:443

64.74.160.218:443

198.46.198.115:443

5.34.180.173:443

23.227.196.5:443

195.123.241.115:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944

    • Size

      424KB

    • MD5

      bc67b9a2dae4bdaad9b1f1fcc2910606

    • SHA1

      bcd589601dea9c11d77e032a8731ab358f042a12

    • SHA256

      862cd5dad314dc8a71a47270e9d6790c064ee0c8980d96f7c61581d380a2c944

    • SHA512

      99b2f95045260fd8edc4b142962d0e8ac95b69725e1f63944af12337f84f44e532f66d32b4260ca55e5ccdff1e942aef4642cc3215f8b0bfc63e0ba8495b5eb1

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks