General
-
Target
561bcbe017d654d6512bac28b7a6be7b40e188ebedd23658ce7e5cca55a14037
-
Size
303KB
-
Sample
220725-ggrw8shbc7
-
MD5
f7c2313af2599186989a09b0de993474
-
SHA1
322144c547d3c998b4e13dc91139017e01247545
-
SHA256
561bcbe017d654d6512bac28b7a6be7b40e188ebedd23658ce7e5cca55a14037
-
SHA512
c9f9caaf3ec0e2feb7c5d260c31fb3a7fdcb9a583f96698c644beb6384799dc41348eddd01ba5387bd0495598a028fc99c986606f3e703332162db00df34d934
Malware Config
Extracted
trickbot
1000257
del67
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
41.211.9.234:449
103.111.53.126:449
182.253.20.66:449
212.225.214.249:449
81.17.86.112:443
78.47.156.178:449
46.149.182.112:449
197.232.243.36:449
94.232.20.113:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
176.10.170.65:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Targets
-
-
Target
561bcbe017d654d6512bac28b7a6be7b40e188ebedd23658ce7e5cca55a14037
-
Size
303KB
-
MD5
f7c2313af2599186989a09b0de993474
-
SHA1
322144c547d3c998b4e13dc91139017e01247545
-
SHA256
561bcbe017d654d6512bac28b7a6be7b40e188ebedd23658ce7e5cca55a14037
-
SHA512
c9f9caaf3ec0e2feb7c5d260c31fb3a7fdcb9a583f96698c644beb6384799dc41348eddd01ba5387bd0495598a028fc99c986606f3e703332162db00df34d934
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Stops running service(s)
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-