General
-
Target
5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325
-
Size
565KB
-
Sample
220731-xzjxcadhel
-
MD5
d61ca02b30b949fcc13e1876304a66a4
-
SHA1
c33de07051e054c0ddeacdbcea94a348681d9233
-
SHA256
5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325
-
SHA512
0c3e7e023c85a4cbe4c285ca8d3fd87d5a3ae65dc5cdc263e78c68956bc07af3457d20bedee31364faf1acd21044bac531106d92488f4a5ab6cc924fd8361f53
Malware Config
Extracted
trickbot
1000275
sat76
51.68.184.101:443
94.181.47.198:449
31.31.161.165:449
158.69.177.176:443
181.113.17.230:449
212.23.70.149:443
185.251.38.178:443
170.81.32.66:449
42.115.91.177:443
54.39.167.242:443
71.94.101.25:443
68.45.243.125:449
192.252.209.44:443
182.50.64.148:449
187.190.249.230:443
107.175.127.147:443
82.222.40.119:449
198.100.157.163:443
23.226.138.169:443
103.110.91.118:449
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Targets
-
-
Target
5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325
-
Size
565KB
-
MD5
d61ca02b30b949fcc13e1876304a66a4
-
SHA1
c33de07051e054c0ddeacdbcea94a348681d9233
-
SHA256
5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325
-
SHA512
0c3e7e023c85a4cbe4c285ca8d3fd87d5a3ae65dc5cdc263e78c68956bc07af3457d20bedee31364faf1acd21044bac531106d92488f4a5ab6cc924fd8361f53
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Stops running service(s)
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-