Overview

overview

10

Static

static

f96104fbec...68.exe

windows7_x64

10

f96104fbec...68.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68
  • Size 432KB
  • Sample211206-vctrxseehm
  • SHA256 f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68
  • MD5 SHA1 SHA512
Score
10/10
trickbottot5bankersuricatatrojan

Malware Config

Extracted

Family

  • trickbot

Version

  • 100009

Botnet

  • tot5

C2

  • 149.54.11.54:449

  • 36.89.191.119:449

  • 41.159.31.227:449

  • 103.150.68.124:449

  • 103.126.185.7:449

  • 103.112.145.58:449

  • 103.110.53.174:449

  • 102.164.208.44:449

  • 194.5.249.143:443

  • 142.202.191.175:443

  • 195.123.241.31:443

  • 45.89.125.214:443

  • 45.83.151.103:443

  • 91.200.103.41:443

  • 66.70.246.0:443

  • 64.74.160.218:443

  • 198.46.198.115:443

  • 5.34.180.173:443

  • 23.227.196.5:443

  • 195.123.241.115:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64

Targets

    • Target
      f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68
    • Size 432KB
    • SHA256 f96104fbecd8ab4cc3f88df6619c13b99b28b2b7923a4b0e1bce6ff062d93b68
    • MD5 SHA1 SHA512
    Score
    10/10
    trickbottot5bankersuricatatrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

      suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

      suricata

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks