Overview

overview

10

Static

static

3

xml1.exe

windows7-x64

10

Resubmissions

13-07-2024 07:04

240713-hwfcesshqg 10

13-07-2024 06:54

240713-hn9w3azhnj 10

24-08-2023 07:19

230824-h5hh5sah24 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xml1.exe

  • Size

    396KB

  • Sample

    240713-hwfcesshqg

  • MD5

    8503ea92f4c9941ee3295978729d98ba

  • SHA1

    d04dfbc5b1335c8408ffb5c58bd966791f748ad3

  • SHA256

    1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53

  • SHA512

    a5dade77d81f3fc49b46d828ea653d55b921e8b65b455dd0a1fa7eba7880b3a86deff0aafd21276a86eb95be948ab61da9771343ccbc24164b31c3a5b18edaa5

  • SSDEEP

    6144:omPt4BMS4GhUjjF0CBTTFCIRroPHQJ/s5xi8uwytwnhJCAfYrewWvoKMyDftxQib:ZPt4BMsOvpAHQJ0G8CAfWWvo1im

Score
10/10
trickbotxml1bankertrojan

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

xml1

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449
Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      xml1.exe

    • Size

      396KB

    • MD5

      8503ea92f4c9941ee3295978729d98ba

    • SHA1

      d04dfbc5b1335c8408ffb5c58bd966791f748ad3

    • SHA256

      1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53

    • SHA512

      a5dade77d81f3fc49b46d828ea653d55b921e8b65b455dd0a1fa7eba7880b3a86deff0aafd21276a86eb95be948ab61da9771343ccbc24164b31c3a5b18edaa5

    • SSDEEP

      6144:omPt4BMS4GhUjjF0CBTTFCIRroPHQJ/s5xi8uwytwnhJCAfYrewWvoKMyDftxQib:ZPt4BMsOvpAHQJ0G8CAfWWvo1im

    Score
    10/10
    trickbotxml1bankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks