General

  • Target

    SecuriteInfo.com.Generic.mg.fa205aec51890234.4491

  • Size

    540KB

  • Sample

    200629-vk6h4vt42j

  • MD5

    fa205aec518902341839b762d68f4dd9

  • SHA1

    0e037ab8e885bf89cf69a96ce377f1cbdd1841dc

  • SHA256

    0c3550bdc4c7d13d675df8fc25536d8b83cdf135c2b4bea0f64607f01ed50f8a

  • SHA512

    f54b02d276af6334d06b69e8c389086ab65940c8b2e7e7b286db8ab082f392eb423bae01ff545516943983beb93be34b1dde5a5a9ba086717c9b4d03e37721fb

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono51

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      SecuriteInfo.com.Generic.mg.fa205aec51890234.4491

    • Size

      540KB

    • MD5

      fa205aec518902341839b762d68f4dd9

    • SHA1

      0e037ab8e885bf89cf69a96ce377f1cbdd1841dc

    • SHA256

      0c3550bdc4c7d13d675df8fc25536d8b83cdf135c2b4bea0f64607f01ed50f8a

    • SHA512

      f54b02d276af6334d06b69e8c389086ab65940c8b2e7e7b286db8ab082f392eb423bae01ff545516943983beb93be34b1dde5a5a9ba086717c9b4d03e37721fb

    Score
    10/10
    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks