General

  • Target

    0c62485c024777634c7fa33d094f3fe1c189d918ede9904aa07d8f243d2f5371

  • Size

    912KB

  • Sample

    221130-vx44dsae58

  • MD5

    0737d85cfb1e2d4a2d13dd35a447e0b4

  • SHA1

    a3493c1751a5457a6fb39af77ce474c2e2da6841

  • SHA256

    0c62485c024777634c7fa33d094f3fe1c189d918ede9904aa07d8f243d2f5371

  • SHA512

    9469b5df3bc38cbe55a84c7211157e87be55af0782255ded0f1bb058cc7e5fe60bcde39ea1358b4abb89020fb5ff77e8d6ba3c3b00ef60f6f2f70cf004d4631b

  • SSDEEP

    12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclw48v1jBq9kKj7Nivzqg:2JkRBALfWye2er556HFBqnj7G+g

Malware Config

Extracted

Family

trickbot

Version

2000025

Botnet

tot39

C2

134.119.186.200:443

45.14.226.115:443

85.204.116.134:443

45.89.127.240:443

195.123.241.195:443

188.34.142.248:443

185.234.72.84:443

108.170.20.72:443

94.158.245.54:443

134.119.186.201:443

45.83.129.224:443

85.93.159.98:449

92.242.214.203:449

202.21.103.194:449

169.239.45.42:449

45.234.248.66:449

103.91.244.102:449

118.67.216.238:449

117.212.193.62:449

201.184.190.59:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      0c62485c024777634c7fa33d094f3fe1c189d918ede9904aa07d8f243d2f5371

    • Size

      912KB

    • MD5

      0737d85cfb1e2d4a2d13dd35a447e0b4

    • SHA1

      a3493c1751a5457a6fb39af77ce474c2e2da6841

    • SHA256

      0c62485c024777634c7fa33d094f3fe1c189d918ede9904aa07d8f243d2f5371

    • SHA512

      9469b5df3bc38cbe55a84c7211157e87be55af0782255ded0f1bb058cc7e5fe60bcde39ea1358b4abb89020fb5ff77e8d6ba3c3b00ef60f6f2f70cf004d4631b

    • SSDEEP

      12288:e0vUJk88BBAL0toWye2eZ4OTjwkwclw48v1jBq9kKj7Nivzqg:2JkRBALfWye2er556HFBqnj7G+g

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks