Overview

overview

10

Static

static

3

picture.exe

windows7-x64

10

picture.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56d1abc258db983700137af8875018ad28c1be912126c54353534341a0083894

  • Size

    431KB

  • Sample

    240309-zstjbaaf9t

  • MD5

    dd8a94edf5823800a1bca78f14c841af

  • SHA1

    d12c7232ec7d18f13ed96c87ed5f7b4e2f65c9c6

  • SHA256

    56d1abc258db983700137af8875018ad28c1be912126c54353534341a0083894

  • SHA512

    e3b7956e1146357cfd3a3615fca086d6c3144caef1b286c9b1db2c885bd6969fe2bef76db8a585cc4f92bb4ec3958f21b0e5dd32c67ba0b297904a08f1f2404a

  • SSDEEP

    6144:DAlz/Uzw2zMPNJv8JvUWQlZ4RG69y/Jm+9cr2HnbbuYtiK/A9Mcpw:clzcwjVJUEZ4R/k/U+NbxAQf

Score
10/10
trickbotmor6bankertrojan

Malware Config

Extracted

Family

trickbot

Version

100008

Botnet

mor6

C2

103.231.115.106:449

117.222.63.100:449

117.254.58.83:449

149.54.11.54:449

170.82.4.64:449

177.11.12.93:449

182.16.187.251:449

187.108.86.48:449

190.152.88.57:449

203.88.149.33:449

36.89.191.119:449

41.159.31.227:449

85.202.128.243:449

92.204.160.82:449

103.150.68.124:449

103.126.185.7:449

103.112.145.58:449

103.110.53.174:449

102.164.208.48:449

102.164.208.44:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      picture.png

    • Size

      615KB

    • MD5

      ae11dfe64032e62f5da834e19ee8280c

    • SHA1

      9d5139e65e36716e9932848d68ce1bb0ed92c86c

    • SHA256

      93b3b0800018230f58cad9b4ec1d13e9336f0f46062dd49bc43a9394c1bdd1b4

    • SHA512

      f2372f089dcf5c039d99a228f948a573cb15dd78d1ef22cafd0ba33a4869c3f297ac62c4e5401834f1acd461298c5f220791bb54c85c4c2bfc6c2bcf54f143fe

    • SSDEEP

      12288:R7dt29E0xWlz1OGuzrRIcBEEPTmWL7SJFHwRA9AmV5tKoO:fWE0xWlAGeVAam8

    Score
    10/10
    trickbotmor6bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks