Resubmissions

14-02-2020 12:34

200214-b6b4743yan 8

13-02-2020 20:57

200213-jdvkxel2ma 10

General

  • Target

    Replycant.exe

  • Size

    496KB

  • Sample

    200213-jdvkxel2ma

  • MD5

    d04c9993c11e884472533b869576fdb5

  • SHA1

    103657d9912a422ba94d5da365acc800a46cad5e

  • SHA256

    dd811507f8068ee522a68aeb52ce6eb14f5b4382e6da2386c305087eebbc853e

  • SHA512

    5d8c28d9b1a875db96282ea532fac16ddc07d81ce5c11a849b077f0c73cba6d00cb1ccd109ca6447c337ae6a081b7a47f9cb3edcc631d305c9753beed698e83c

Malware Config

Extracted

Family

trickbot

Version

1000498

Botnet

ono30

C2

5.182.210.226:443

82.146.62.52:443

164.68.120.56:443

185.11.146.86:443

5.2.78.70:443

185.65.202.240:443

193.26.217.243:443

81.177.180.254:443

5.34.177.40:443

185.186.77.222:443

188.227.84.209:443

193.26.217.243:443

185.45.193.76:443

46.229.213.27:443

88.99.112.87:443

51.254.164.240:443

45.148.120.13:443

5.2.78.77:443

64.44.51.125:443

107.172.165.149:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      Replycant.exe

    • Size

      496KB

    • MD5

      d04c9993c11e884472533b869576fdb5

    • SHA1

      103657d9912a422ba94d5da365acc800a46cad5e

    • SHA256

      dd811507f8068ee522a68aeb52ce6eb14f5b4382e6da2386c305087eebbc853e

    • SHA512

      5d8c28d9b1a875db96282ea532fac16ddc07d81ce5c11a849b077f0c73cba6d00cb1ccd109ca6447c337ae6a081b7a47f9cb3edcc631d305c9753beed698e83c

    Score
    10/10
    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • Trickbot's 32bit loader

      Detects Trickbot's 32bit loader.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks