General

  • Target

    3798bb4ac653efdcac93938982f373ab77a26d64d0ce0fd7adc1861935a29377

  • Size

    454KB

  • Sample

    240831-ghg4esydqr

  • MD5

    94cd1ba67b33cc9bf6ec5f24a4345ec8

  • SHA1

    57b9794246bf9040904034c04c84885e4e302a81

  • SHA256

    3798bb4ac653efdcac93938982f373ab77a26d64d0ce0fd7adc1861935a29377

  • SHA512

    4a908538e478aef252146e7fdfb66d6f51c764df74a9843602609425cdfa07462d54efcc3a89ddb70f90ae7f1f26ed2e9d41af4d8a324bae900775a38ae44ec6

  • SSDEEP

    12288:UqaMsYm9NHdmbZqKeT8KBYA41xoSoJoCgn2pzVK:ULMRm9N0tCBWoSoC2xVK

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

tot166

C2

36.91.117.231:443

36.89.228.201:443

103.75.32.173:443

45.115.172.105:443

36.95.23.89:443

103.123.86.104:443

202.65.119.162:443

202.9.121.143:443

139.255.65.170:443

110.172.137.20:443

103.146.232.154:443

36.91.88.164:443

103.47.170.131:443

122.117.90.133:443

103.9.188.78:443

210.2.149.202:443

118.91.190.42:443

117.222.61.115:443

117.222.57.92:443

136.228.128.21:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      d1bcf94e6f30981c5e9bb4bc0c135cdc19d84368129948f04c3a8949ca4df9dc

    • Size

      868KB

    • MD5

      65f49a4a32100f31755c0bbefb8de911

    • SHA1

      8b434ceb7c63acac87eb43d302acffa207e30844

    • SHA256

      d1bcf94e6f30981c5e9bb4bc0c135cdc19d84368129948f04c3a8949ca4df9dc

    • SHA512

      48ada35d8fb5120a72da6c63b382d4d93ccd5c7294d780ab07554d12d160196ccced2ad118e639e85964927f2c6887e87c05545f217e6078567d103f91d89abf

    • SSDEEP

      12288:DEMkCMMFkUED6ANs4ZD9V63Az2hPmy+khUzJUb/z:m+ED6+xZzkmii2z

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Enterprise v15

Tasks