General
-
Target
8bf06a4c2ef57383efdc8fe9b9860c8ede70c63f158b1f58ea9f1fb564710f50
-
Size
352KB
-
Sample
220731-frg94sheb8
-
MD5
99246603209088dc1a80d4c9cd30f2db
-
SHA1
d1a7f86f975b6d80f7663397c8558d04f0e663cd
-
SHA256
8bf06a4c2ef57383efdc8fe9b9860c8ede70c63f158b1f58ea9f1fb564710f50
-
SHA512
78b2e96f5abd4eb110183a7a11fd7f4e686d54a82cad62e4e4d5aca7ff0626ed97d242481942ef27c0b8bce9a336450c3821ff01f814bad7e155d3f89a92b706
Static task
static1
Behavioral task
behavioral1
Sample
8bf06a4c2ef57383efdc8fe9b9860c8ede70c63f158b1f58ea9f1fb564710f50.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
8bf06a4c2ef57383efdc8fe9b9860c8ede70c63f158b1f58ea9f1fb564710f50.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
trickbot
1000192
lib222
209.121.142.202:449
5.102.177.205:449
209.121.142.214:449
95.161.180.42:449
203.86.222.142:449
109.95.114.28:449
118.91.178.106:449
173.220.6.194:449
179.107.89.145:449
46.20.207.204:449
91.206.4.216:449
69.122.117.95:449
68.96.73.154:449
185.42.192.194:449
189.84.125.37:449
68.227.31.46:449
107.144.49.162:449
46.72.175.17:449
144.48.51.8:449
46.243.179.212:449
191.6.18.166:449
81.177.255.76:449
94.250.251.49:443
80.93.182.51:443
37.230.116.77:443
185.174.172.20:443
82.146.57.73:443
82.146.62.210:443
37.230.112.67:443
80.87.197.152:443
37.230.116.56:443
91.235.129.15:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Targets
-
-
Target
8bf06a4c2ef57383efdc8fe9b9860c8ede70c63f158b1f58ea9f1fb564710f50
-
Size
352KB
-
MD5
99246603209088dc1a80d4c9cd30f2db
-
SHA1
d1a7f86f975b6d80f7663397c8558d04f0e663cd
-
SHA256
8bf06a4c2ef57383efdc8fe9b9860c8ede70c63f158b1f58ea9f1fb564710f50
-
SHA512
78b2e96f5abd4eb110183a7a11fd7f4e686d54a82cad62e4e4d5aca7ff0626ed97d242481942ef27c0b8bce9a336450c3821ff01f814bad7e155d3f89a92b706
Score10/10-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-