trickbot | d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80

General

Target
24776324204.zip
Size 263KB
Sample260415-a7ksaacy7q
SHA256 d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80
MD5 48e5a5a7b307c09de2e61ab4736f7005
SHA1 af8247f2e23b80e3a75924682b469f5da6ed7dfc
SHA512 bd08ae6e1ee1a8ec486fbe93dc520e80f97c37f74bcece72373c28caf70aeeaf4013aa5957e0973198a695039844f7d0c5aad3e4c1c92804f07e88728bc27b59
SSDEEP 6144:3nrjwgOa/NMpv/F9sQuckTRMai3Xh4lxef:3ga/KpnvMxTRli3yzw
TLSH
T1EA4423BBE1E895C9515D299C09595A24337DCF8049DD67F736EEC0FB28C3230392A867
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

1000210

Botnet

tot245

C2

188.124.167.132:449
93.109.242.134:443
41.211.9.226:443
158.58.131.54:443
36.74.100.211:449
87.255.24.238:449
200.111.167.227:449
109.86.227.152:443
85.172.38.59:449
190.4.189.129:443
65.30.201.40:443
66.232.212.59:443
80.53.57.146:443
182.253.210.130:449
155.133.31.21:449
94.112.52.197:449
209.121.142.202:449
5.102.177.205:449
209.121.142.214:449
185.42.192.194:449
144.48.51.8:443
185.174.172.180:443
185.249.255.31:443
185.174.173.138:443
92.63.107.235:443
62.109.16.54:443
92.53.67.19:443
89.223.88.121:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Targets

- Target
  24776324204.zip
- Size 263KB
- SHA256 d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80
- MD5 48e5a5a7b307c09de2e61ab4736f7005
- SHA1 af8247f2e23b80e3a75924682b469f5da6ed7dfc
- SHA512 bd08ae6e1ee1a8ec486fbe93dc520e80f97c37f74bcece72373c28caf70aeeaf4013aa5957e0973198a695039844f7d0c5aad3e4c1c92804f07e88728bc27b59
- SSDEEP 6144:3nrjwgOa/NMpv/F9sQuckTRMai3Xh4lxef:3ga/KpnvMxTRli3yzw
- TLSH
  T1EA4423BBE1E895C9515D299C09595A24337DCF8049DD67F736EEC0FB28C3230392A867
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1
- Target
  005ce041948cce1950e2888c100580851e10a50ad4ff0e534ea3884bfad2d7cd
- Size 328KB
- SHA256 005ce041948cce1950e2888c100580851e10a50ad4ff0e534ea3884bfad2d7cd
- MD5 fc4118afa84f8aea26419db2016cd2a8
- SHA1 f1fd7fbe02c07affa3a2f7df15d4c9747add2603
- SHA512 2d78cc76891ad44d7a294ebd4120bb2fcbc04824f807869d68b9f7b61cc60fdc90203a6dbcb1a6415be52d58e0dd4688e5d20e0dd5506a2c912236038481956c
- SSDEEP 6144:riEN2nK841d3pAg6SEyLlhFp0l94dLpuoo+Pt3LpFfsBvg5vdHL9:ri3J41HU4Gl9sxNZVR
- TLSH
  T16A64DF276DAE4063C210C4F1DBE590F66A28EC77F841543FA756BE292B70C831AE3576
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker tot245 discovery trickbot persistence trojan
- Family: Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral2