Trickbot EXE files from ".png" URLs on Friday 2020-04-10

TRICKBOT EXE FILES FROM .PNG URLs ON FRIDAY 2020-04-10

URLS:

- hxxp://64.44.133[.]154/images/cursor.png
- hxxp://64.44.133[.]154/images/imgpaper.png
- hxxp://64.44.133[.]154/images/redcar.png

NOTES:

- At least one of these URLs was submitted to VirusTotal as early as Wednesday 2020-04-08.
- The http request for cursor.png is caused by Trickbot's mshareDll module.
- The http request for imgpaper.png is caused by Trickbot's tabDll module.
- The http request for redcar.png is caused by Trickbot's mwormDll module.
- All of these URLs returned a Windows executable file (EXE).
- Each of these Trickbot EXE has a different gtag.
- These URLs may return files with different hashes every time they are retrieved.

FILE INFO:

- SHA256 hash: 5dc263d7f0ecb3a74e3d60fde5937b82c6538872b107dc86aab3a7a17d257f12
- File size: 637,440 bytes
- File location: hxxp://64.44.133[.]154/images/cursor.png
- File description: Windows executable file for Trickbot, gtag tot713
- Analysis:
 -- https://urlhaus.abuse.ch/url/338121/
 -- https://app.any.run/tasks/97865e8b-8d76-4490-9c88-bedf110f74a5/
 -- https://capesandbox.com/analysis/893/
 -- https://www.hybrid-analysis.com/sample/5dc263d7f0ecb3a74e3d60fde5937b82c6538872b107dc86aab3a7a17d257f12

- SHA256 hash: 4b2ce158a065f0bf1dbb821266e4a656458623598166680934223f9346c91d11
- File size: 637,440 bytes
- File location: hxxp://64.44.133[.]154/images/imgpaper.png
- File description: Windows executable file for Trickbot, gtag lib713
- Analysis:
 -- https://urlhaus.abuse.ch/url/338122/
 -- https://app.any.run/tasks/1a3a29e-6c9d-42cc-bb22-f7cb31eff0f5/
 -- https://capesandbox.com/analysis/894/
 -- https://www.hybrid-analysis.com/sample/4b2ce158a065f0bf1dbb821266e4a656458623598166680934223f9346c91d11

- SHA256 hash: 2c04e6d8af5e083476086ce90d310f0ad8e13a30a9678392e912798f9a53c6fb
- File size: 638,976 bytes
- File location: hxxp://64.44.133[.]154/images/redcar.png
- File description: Windows executable file for Trickbot, gtag jim713
- Analysis:
 -- https://urlhaus.abuse.ch/url/338123/
 -- https://app.any.run/tasks/97ee36e5-ff5b-4e53-b6de-a1c9673e3f67/
 -- https://capesandbox.com/analysis/895/
 -- https://www.hybrid-analysis.com/sample/2c04e6d8af5e083476086ce90d310f0ad8e13a30a9678392e912798f9a53c6fb