General

  • Target

    920763e0b7237d2d67608c91b6c17e67d6596f48e1d1b01c52157acccd591dc5

  • Size

    516KB

  • Sample

    240921-g4r6hsyfkj

  • MD5

    4308854edeb40c0b7404558d52cc8cb9

  • SHA1

    e9f9d4f9069edef1b2298f40479d10035ea3caf7

  • SHA256

    920763e0b7237d2d67608c91b6c17e67d6596f48e1d1b01c52157acccd591dc5

  • SHA512

    762c2645716c4dcdfaa2b63a0173f49e1086342948704e2e31f2a75ad886170d81da4b4ad2c37bbef77237752973930cd5d44cbd3ce47d1d04e56baad595dd2d

  • SSDEEP

    12288:VE2DFZrTO3Xx3jLOBWTNvFD1VeubeMl2005W7eQT:VrrTO3B3WwZv91VeAlXw

Malware Config

Extracted

Family

trickbot

Version

100018

Botnet

sat2

C2

38.110.103.124:443

185.56.76.28:443

204.138.26.60:443

60.51.47.65:443

74.85.157.139:443

68.69.26.182:443

38.110.103.136:443

38.110.103.18:443

138.34.28.219:443

185.56.76.94:443

217.115.240.248:443

24.162.214.166:443

80.15.2.105:443

154.58.23.192:443

38.110.100.104:443

45.36.99.184:443

185.56.76.108:443

185.56.76.72:443

138.34.28.35:443

97.83.40.67:443

Attributes
  • autorun
    Name:pwgrabb
    Name:pwgrabc
ecc_pubkey.base64

Targets

    • Target

      920763e0b7237d2d67608c91b6c17e67d6596f48e1d1b01c52157acccd591dc5

    • Size

      516KB

    • MD5

      4308854edeb40c0b7404558d52cc8cb9

    • SHA1

      e9f9d4f9069edef1b2298f40479d10035ea3caf7

    • SHA256

      920763e0b7237d2d67608c91b6c17e67d6596f48e1d1b01c52157acccd591dc5

    • SHA512

      762c2645716c4dcdfaa2b63a0173f49e1086342948704e2e31f2a75ad886170d81da4b4ad2c37bbef77237752973930cd5d44cbd3ce47d1d04e56baad595dd2d

    • SSDEEP

      12288:VE2DFZrTO3Xx3jLOBWTNvFD1VeubeMl2005W7eQT:VrrTO3B3WwZv91VeAlXw

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Enterprise v15

Tasks