| Hash / Bilgi | Deger |
|---|---|
| SHA256 | 996b9e029e0d93efa265c69b2cf1cfac64b3b848ae936b2c43f2decdd591757e |
| MD5 | db86be5c9d964461352838299b3f9ded |
| SHA1 | a73c35fa1b378170ac7d7f2caccf083728564bc4 |
| ImpHash | 50610e34092d6ce13e51e7c9d5197081 |
| Dosya Adi | 996b9e029e0d93efa265c69b2cf1cfac64b3b848ae936b2c43f2decdd591757e |
| Dosya Türü | exe |
| Boyut | 237,937 bytes |
| Ilk Görülme | 2022-08-12 |
Tehdit Degerlendirmesi
Bu ornek, hedef sisteme ek zararlı yazılım yuklemek amacıyla tasarlanmis moduler bir yukleyici (loader) olarak tespit edilmistir. Bankacılık trojanları, fidye yazılımları veya diger ikinci asama yukler indirebilmektedir.
Tespit Edilen Yetenekler
- Payload Indirme
- Surec Enjeksiyonu
- Kalicilik
- Anti-Analiz
- Sifrelenmis Iletisim
MalwareBazaar Etiketleri
Analiz Notu
Bu ornek TrickBot ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
TrickBot — マルウェアプロファイル
TrickBot modular banking trojan. DGA filename. WTSSetUserConfigW RDP targeting. RegUnLoadKeyA registry hive dump.
技術詳細
TrickBot is a modular banking trojan and loader developed by WIZARD SPIDER since 2016. Evolved from Dyre banking trojan with modular architecture allowing plugin-based functionality. Modules: pwgrab (credential theft), networkdll (network reconnaissance), shareDll (SMB spread), tabDll (browser form grabbing), vncDll (remote access), mworm/nworm (propagation). Used extensively to deliver Ryuk and Conti ransomware. C2 communication: HTTPS with custom User-Agent strings. Infrastructure disrupted by Microsoft/ESET/Symantec/CISA in October 2020. Key operators arrested/sanctioned; infrastructure rebuilt multiple times. Shifted focus from banking to enterprise ransomware delivery (2019-2022).
アトリビューション / 脅威アクター
WIZARD SPIDER, Dyre successor
機能と挙動
IOCリスト (2 件の指標)
# SHA256
996b9e029e0d93efa265c69b2cf1cfac64b3b848ae936b2c43f2decdd591757e
# MD5
db86be5c9d964461352838299b3f9ded
| タイプ | 値 | メモ |
|---|---|---|
| sha256 | 996b9e029e0d93efa265c69b2cf1cfac64b3b848ae936b2c43f2decdd591757e | |
| md5 | db86be5c9d964461352838299b3f9ded |
C2サーバー (このファミリーで7台のサーバーを記録)
| アドレス | タイプ | ポート | プロトコル | ステータス | 国 |
|---|---|---|---|---|---|
| 176.111.174.70 | ip | 443 | HTTPS | inactive | RU |
| 45.156.25.1 | ip | 443 | HTTPS | sinkholed | RU |
| 185.234.218.151 | ip | 443 | HTTPS | sinkholed | RU |
| 82.117.252.143 | ip | 449 | HTTPS | sinkholed | DE |
| 45.147.231.250 | ip | 443 | HTTPS | sinkholed | NL |
| 31.214.157.14 | ip | 443 | HTTPS | sinkholed | UA |
| 185.234.219.77 | ip | 449 | HTTPS | sinkholed | RU |
C2アドレスはKEYDALチームが手動で検証したマルウェア検体のみに基づいて提供されています。商用利用は禁止です。