General
-
Target
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
-
Size
299KB
-
Sample
221130-xkfalshh5v
-
MD5
b1f04b467115b366a8d8b76fd4da6cc7
-
SHA1
860f3a96d57984d0112521e9eb31e30ed2498033
-
SHA256
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
-
SHA512
80f3ddefaf0627e12cf7569afb83789384788e9cd65aea4a7eb8f3f030469fd067e4e4c029512857ee28c2011e8076d1d97ac676524c79bf987dc337f088d5ae
-
SSDEEP
6144:eAiBe5v1c1TGVMftOGoBButUAG7l7eNwVIeCi0a5bZq/4kCBuc:xig5y9i2OrIUAG7l7eNwVI6vKAkCB
Malware Config
Extracted
trickbot
1000263
tot314
118.97.119.218:449
94.181.47.198:449
144.121.143.129:449
185.200.60.138:449
185.42.52.126:449
181.174.112.74:449
178.116.83.49:443
121.58.242.206:449
182.50.64.148:449
82.222.40.119:449
97.78.222.18:449
67.79.15.106:449
168.167.87.79:443
103.111.53.126:449
182.253.20.66:449
192.188.120.164:443
81.17.86.112:443
95.154.80.154:449
46.149.182.112:449
69.9.232.167:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Targets
-
-
Target
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
-
Size
299KB
-
MD5
b1f04b467115b366a8d8b76fd4da6cc7
-
SHA1
860f3a96d57984d0112521e9eb31e30ed2498033
-
SHA256
225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6
-
SHA512
80f3ddefaf0627e12cf7569afb83789384788e9cd65aea4a7eb8f3f030469fd067e4e4c029512857ee28c2011e8076d1d97ac676524c79bf987dc337f088d5ae
-
SSDEEP
6144:eAiBe5v1c1TGVMftOGoBButUAG7l7eNwVIeCi0a5bZq/4kCBuc:xig5y9i2OrIUAG7l7eNwVI6vKAkCB
Score10/10-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Executes dropped EXE
-
Stops running service(s)
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-