General

  • Target

    0c9de20fdae605ec21c4f526df984984.zip

  • Size

    454KB

  • Sample

    240831-km899aveql

  • MD5

    0742f906563f222b2ccf985fc3caa298

  • SHA1

    91ee4d275248fa011f0f82049b1218ef1014d0cf

  • SHA256

    7691f67beaab611f00b727a4166f9d860bc1fe4850abb9b2b05d0f32506d14bf

  • SHA512

    4cbc3f5327c793ce892ecd8727d16770b0b29993c3cffc8884e7824dbef40a177c2611a1e70bf7c3aa94029fb476d0f95e53585b405b8a1c164db32195e95e8e

  • SSDEEP

    6144:KsPYLL4SgmlWqNWphgx4e++gttWHJ/Vv9+TryeQeAluRKu0po0wx1UhHSkysEU9N:pYLUJ1qyeot8x0AluRKO0wx1kSTU9FL

Malware Config

Extracted

Family

trickbot

Version

2000035

Botnet

tot166

C2

36.91.117.231:443

36.89.228.201:443

103.75.32.173:443

45.115.172.105:443

36.95.23.89:443

103.123.86.104:443

202.65.119.162:443

202.9.121.143:443

139.255.65.170:443

110.172.137.20:443

103.146.232.154:443

36.91.88.164:443

103.47.170.131:443

122.117.90.133:443

103.9.188.78:443

210.2.149.202:443

118.91.190.42:443

117.222.61.115:443

117.222.57.92:443

136.228.128.21:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      51160720eeb17dc28420f8e2b3b374cc604193f63460c7a6b4f9640c161e3020

    • Size

      868KB

    • MD5

      0c9de20fdae605ec21c4f526df984984

    • SHA1

      424c51d8286541b44b9c665aae960274aee772c2

    • SHA256

      51160720eeb17dc28420f8e2b3b374cc604193f63460c7a6b4f9640c161e3020

    • SHA512

      9f437aa303dd643225719f381d966b6ee0691536455b15ebd56ae052b3cee2fc5393d59ca0f5825b870002608fcb0f144c45c2f0e23bdb5226ea4901d110efc7

    • SSDEEP

      12288:DEMkCMMFkUED6ANs4ZD9V63Az2hPmy+khUzJUS/G:m+ED6+xZzkmiiZG

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Enterprise v15

Tasks