trickbot

General

Target

embarf.point
Size

338KB
Sample

230630-p3d69sdf7x
MD5

884dab96c679194fc5140322d5ce9e9d
SHA1

e7277a259a6f05bb74c14324f97b9513c8d4d9e5
SHA256

5b6661b43c17ad12172c4327aa4b79be8bcf1c421cb08d6bff19f7e26282e9d8
SHA512

b3c18425d6c6712f7e7c31909af128628aa95af55f1de7632399276b630e8be9448fb10d5c29e77ac83522bf130e34cd1a3a7ad5875876a60e5a3069e7340b30
SSDEEP

6144:Z3sKPN+ClFKSXUJsckFikntN1PknaA4fk/QVoik1eeedH815slE:Z3sKACi3dTkntknx4fk4Vor8W

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

2000026

Botnet

rob16

C2

154.79.252.132:449

179.191.108.58:449

200.6.169.124:443

103.76.20.226:443

80.78.77.116:449

80.78.75.246:443

45.234.248.66:449

187.190.116.59:443

185.234.72.84:443

36.94.202.131:443

103.91.244.102:449

168.232.188.88:449

103.73.101.98:449

173.81.4.147:449

202.142.151.190:449

118.67.216.238:449

108.170.20.72:443

85.159.214.61:443

36.92.93.5:449

79.122.166.236:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Targets

- Target
  
  embarf.point
- Size
  
  338KB
- MD5
  
  884dab96c679194fc5140322d5ce9e9d
- SHA1
  
  e7277a259a6f05bb74c14324f97b9513c8d4d9e5
- SHA256
  
  5b6661b43c17ad12172c4327aa4b79be8bcf1c421cb08d6bff19f7e26282e9d8
- SHA512
  
  b3c18425d6c6712f7e7c31909af128628aa95af55f1de7632399276b630e8be9448fb10d5c29e77ac83522bf130e34cd1a3a7ad5875876a60e5a3069e7340b30
- SSDEEP
  
  6144:Z3sKPN+ClFKSXUJsckFikntN1PknaA4fk/QVoik1eeedH815slE:Z3sKACi3dTkntknx4fk4Vor8W
Score

10^/10

trickbot rob16 banker packer trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Templ.dll packer
  Detects Templ.dll packer which usually loads Trickbot.
  packer
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Extracted

Targets

Templ.dll packer

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2