trickbot | 8a84323eb28738acc7a3f00cddac5a4c2620b903cc276d054ec93e20ba65f17e | Triage

Sharing

General

Target

8a84323eb28738acc7a3f00cddac5a4c2620b903cc276d054ec93e20ba65f17e
Size

341KB
Sample

230129-whdtbsgb37
MD5

3fc659307c771e566dbc83bddf956d08
SHA1

b83c1fecf23b75a9d97a58c2b526d105e31b72d2
SHA256

8a84323eb28738acc7a3f00cddac5a4c2620b903cc276d054ec93e20ba65f17e
SHA512

5f1d07f91b176145ec206c7e831702c2d07ccb3dc6df92d657f7027b67a6e35391f8ae0410742ce9fdfd1f03252caf2803b37abf9d84a5034296476ebd6bad7a
SSDEEP

6144:/D4xA1AsitoTemJ5HMihpmtXNkTAzYjS8yfaJO22Yv888vX7QGkWGfx:/Dv1ANuCmJ5HRpmgcYO8yfaJdD

Score

10^/10

trickbot mon73 banker packer trojan

Malware Config

Extracted

Family

trickbot

Version

100011

Botnet

mon73

C2

194.5.249.156:443

142.202.191.164:443

193.8.194.96:443

45.155.173.242:443

108.170.20.75:443

185.163.45.138:443

94.140.114.136:443

134.119.186.202:443

200.52.147.93:443

45.230.244.20:443

186.250.157.116:443

186.137.85.76:443

36.94.62.207:443

182.253.107.34:443

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  8a84323eb28738acc7a3f00cddac5a4c2620b903cc276d054ec93e20ba65f17e
- Size
  
  341KB
- MD5
  
  3fc659307c771e566dbc83bddf956d08
- SHA1
  
  b83c1fecf23b75a9d97a58c2b526d105e31b72d2
- SHA256
  
  8a84323eb28738acc7a3f00cddac5a4c2620b903cc276d054ec93e20ba65f17e
- SHA512
  
  5f1d07f91b176145ec206c7e831702c2d07ccb3dc6df92d657f7027b67a6e35391f8ae0410742ce9fdfd1f03252caf2803b37abf9d84a5034296476ebd6bad7a
- SSDEEP
  
  6144:/D4xA1AsitoTemJ5HMihpmtXNkTAzYjS8yfaJO22Yv888vX7QGkWGfx:/Dv1ANuCmJ5HRpmgcYO8yfaJdD
Score

10^/10

trickbot mon73 banker packer trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Templ.dll packer
  Detects Templ.dll packer which usually loads Trickbot.
  packer
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

trickbotmon73bankerpackertrojan

behavioral2

trickbotmon73bankerpackertrojan