General

  • Target

    SecuriteInfo.com.Trojan.Packed.140.28934.24660

  • Size

    468KB

  • Sample

    200801-b2xafhfv6x

  • MD5

    94096516b03e941a615e0b242d3deb34

  • SHA1

    94ac501fb466b9fcd48221d5295c5443c8471501

  • SHA256

    dec9aa80ad429dfe99695c87c73b1721e68ee77997d5d04737e2f0a3214db1d8

  • SHA512

    cdf99dd7fc16efb8c610017e7db73a7d40e743d91d770a941d35fa5fb6abe43bc5cd501f26a7a818b8ae697be530f2272a215b2f6a18d8c0a285e87b0d1114dc

Malware Config

Extracted

Family

trickbot

Version

1000512

Botnet

ono57

C2

95.171.16.42:443

185.90.61.9:443

5.1.81.68:443

185.99.2.65:443

134.119.191.11:443

85.204.116.100:443

78.108.216.47:443

51.81.112.144:443

194.5.250.121:443

185.14.31.104:443

185.99.2.66:443

107.175.72.141:443

192.3.247.123:443

134.119.191.21:443

85.204.116.216:443

91.235.129.20:443

181.129.104.139:449

181.112.157.42:449

181.129.134.18:449

131.161.253.190:449

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target

      SecuriteInfo.com.Trojan.Packed.140.28934.24660

    • Size

      468KB

    • MD5

      94096516b03e941a615e0b242d3deb34

    • SHA1

      94ac501fb466b9fcd48221d5295c5443c8471501

    • SHA256

      dec9aa80ad429dfe99695c87c73b1721e68ee77997d5d04737e2f0a3214db1d8

    • SHA512

      cdf99dd7fc16efb8c610017e7db73a7d40e743d91d770a941d35fa5fb6abe43bc5cd501f26a7a818b8ae697be530f2272a215b2f6a18d8c0a285e87b0d1114dc

    Score
    10/10
    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

MITRE ATT&CK Matrix

Tasks