Trickbot propagation URLs (and EXEs) on Thursday 2020-05-28

TRICKBOT PROPAGATION URLS (AND EXES) ON THURSDAY 2020-05-28

URLS:

- hxxp://162.216.0[.]163/ico/VidT6cErs
- hxxp://162.216.0[.]163/images/cursor.png
- hxxp://162.216.0[.]163/images/imgpaper.png
- hxxp://162.216.0[.]163/images/redcar.png

NOTES:

- The HTTP request for VidT6cErs is caused by Trickbot's nwormDll module (jim-series gtag).
- The HTTP request for cursor.png is caused by Trickbot's mshareDll module (tot-series gtag).
- The HTTP request for imgpaper.png is caused by Trickbot's tabDll module (lib-series gtag).
- The HTTP request for redcar.png was caused by Trickbot's old mwormDll module, but it can still retrieve Trickbot EXEs with jim-series gtags, presumably with associated with the new nwormDll module.

More info on the new "nworm" module used by Trickbot:

- https://unit42.paloaltonetworks.com/goodbye-mworm-hello-nworm-trickbot-updates-propagation-module/

$ file *.png
VidT6cErs:    data
cursor.png:   PE32 executable (GUI) Intel 80386, for MS Windows
imgpaper.png: PE32 executable (GUI) Intel 80386, for MS Windows
redcar.png:   PE32 executable (GUI) Intel 80386, for MS Windows

FILE INFO:

- SHA256 hash: 7afa5dec9cd50b65cc272965bff7ed474fd15599cfb9eff3f86fdc41671e2612
- File size: 359,424 bytes
- File location: hxxp://162.216.0[.]163/ico/VidT6cErs
- File description: encoded binary (not an executable) associated with nwormDll for Trickbot, gtag jim734
- Analysis:
 -- https://urlhaus.abuse.ch/url/371429/
 -- https://app.any.run/tasks/d2d8e69a-02da-41ac-87a0-f6b6e471a292
 -- https://capesandbox.com/analysis/5230/
 -- https://www.hybrid-analysis.com/sample/7afa5dec9cd50b65cc272965bff7ed474fd15599cfb9eff3f86fdc41671e2612

- SHA256 hash: d49371ff32fb4581d091429a990b972465c7bcc47a2877ba91e7fb64f1843ce3
- File size: 503,808 bytes
- File location: hxxp://162.216.0[.]163/images/cursor.png
- File description: Windows executable file associated with mshareDll for Trickbot, gtag tot734
- Analysis:
 -- https://urlhaus.abuse.ch/url/371428/
 -- https://app.any.run/tasks/d466b4f5-6ecd-4c88-8e6e-437048f1a061
 -- https://capesandbox.com/analysis/5220/
 -- https://www.hybrid-analysis.com/sample/d49371ff32fb4581d091429a990b972465c7bcc47a2877ba91e7fb64f1843ce3

- SHA256 hash: 80cacb103845c0788affd5df5923c6973816ae87c285befee05c6c336fe29b2a
- File size: 503,808 bytes
- File location: hxxp://162.216.0[.]163/images/imgpaper.png
- File description: Windows executable file associated with tabDll for Trickbot, gtag lib734
- Analysis:
 -- https://urlhaus.abuse.ch/url/371427/
 -- https://app.any.run/tasks/ed45d774-f541-494f-83b7-b991c79e0867/
 -- https://capesandbox.com/analysis/5221/
 -- https://www.hybrid-analysis.com/sample/80cacb103845c0788affd5df5923c6973816ae87c285befee05c6c336fe29b2a

- SHA256 hash: 008d6dac88a54cacf184b46ccc6777abe88002802914f11139b575457579f67e
- File size: 516,096 bytes
- File location: hxxp://162.216.0[.]163/images/redcar.png
- File description: Windows executable file for Trickbot, gtag jim734 (URL associated with the old "mworm" module)
- Analysis:
 -- https://urlhaus.abuse.ch/url/371433/
 -- https://app.any.run/tasks/c68ca39d-c046-49ee-b764-5be7cea148f1/
 -- https://capesandbox.com/analysis/5226/
 -- https://www.hybrid-analysis.com/sample/008d6dac88a54cacf184b46ccc6777abe88002802914f11139b575457579f67e