Overview

overview

10

Static

static

3

005ce04194...cd.exe

windows11-21h2-x64

10

Resubmissions

17/04/2026, 00:57

260417-bazevags8x10

15/04/2026, 01:17

260415-bnwk4sds2k10

15/04/2026, 01:12

260415-bkvjmsc16m

15/04/2026, 00:51

260415-a7ksaacy7q10

30/03/2026, 07:17

260330-h4renagv8t10

Sharing

Copy URL Twitter E-mail

General

  • Target
    24776324204.zip
  • Size 263KB
  • Sample260415-bnwk4sds2k
  • SHA256 d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trickbottot245bankerdiscoverypersistencephishingtrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 1000210

Botnet

  • tot245

C2

  • 188.124.167.132:449

  • 93.109.242.134:443

  • 41.211.9.226:443

  • 158.58.131.54:443

  • 36.74.100.211:449

  • 87.255.24.238:449

  • 200.111.167.227:449

  • 109.86.227.152:443

  • 85.172.38.59:449

  • 190.4.189.129:443

  • 65.30.201.40:443

  • 66.232.212.59:443

  • 80.53.57.146:443

  • 182.253.210.130:449

  • 155.133.31.21:449

  • 94.112.52.197:449

  • 209.121.142.202:449

  • 5.102.177.205:449

  • 209.121.142.214:449

  • 185.42.192.194:449

Attributes
  • autorun
    Control:GetSystemInfo
    Name:systeminfo
    Name:injectDll
ecc_pubkey.base64

Targets

    • Target
      005ce041948cce1950e2888c100580851e10a50ad4ff0e534ea3884bfad2d7cd
    • Size 328KB
    • SHA256 005ce041948cce1950e2888c100580851e10a50ad4ff0e534ea3884bfad2d7cd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bankertot245discoverytrickbotpersistencephishingtrojan

    • Family: Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks