General

  • Target

    1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.zip

  • Size

    286KB

  • Sample

    231119-2bjc5ada7t

  • MD5

    4d8823dafc45540c489bb4da4d0554b0

  • SHA1

    97491e1fd9fd52686ac76e5da55ca43072c6282e

  • SHA256

    1a15dc9e5f2e6b32daf4d0fa6767166dfee86a739feb666b08119c3cf177d8cf

  • SHA512

    0e231b48e1aed4edb1ed14ac060c2c19beb5afd5aedf8db6c129eb89e49f924441bce4ea657d9317ab173cc3c35227abe80bed5e7c81829532c5a5e42af8f530

  • SSDEEP

    6144:VjkS+baiB5WUssSIY3Oz+tYK4k/iXK1MV8v1fV2xItz10nBxJvX5dw:VjkS8l8jGY+++SIYMyeCmBs

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

xml1

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53.exe

    • Size

      396KB

    • MD5

      8503ea92f4c9941ee3295978729d98ba

    • SHA1

      d04dfbc5b1335c8408ffb5c58bd966791f748ad3

    • SHA256

      1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53

    • SHA512

      a5dade77d81f3fc49b46d828ea653d55b921e8b65b455dd0a1fa7eba7880b3a86deff0aafd21276a86eb95be948ab61da9771343ccbc24164b31c3a5b18edaa5

    • SSDEEP

      6144:omPt4BMS4GhUjjF0CBTTFCIRroPHQJ/s5xi8uwytwnhJCAfYrewWvoKMyDftxQib:ZPt4BMsOvpAHQJ0G8CAfWWvo1im

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks