Created
October 14, 2016 15:46
-
-
Save hasherezade/3e119be9a1ed1b3b55d8f11e1b5c23b4 to your computer and use it in GitHub Desktop.
strings from the sample: f24384228fb49f9271762253b0733123
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Text strings referenced in payload_:.text | |
| Address Text string | |
| 004012EE UNICODE "TrickBot" | |
| 0040131C UNICODE "Bot" | |
| 004013D2 UNICODE "Bot" | |
| 00401432 UNICODE "PT0S" | |
| 004014F8 UNICODE "Author Name" | |
| 00401559 UNICODE "Trigger1" | |
| 00401590 (Initial CPU selection) | |
| 004015F3 UNICODE "P1D" | |
| 0040162A UNICODE "PT1M" | |
| 00401745 UNICODE "SYSTEM" | |
| 0040176C UNICODE "Bot" | |
| 0040189C UNICODE "Bot" | |
| 00401AB0 UNICODE "TrickBot" | |
| 00401AD2 UNICODE "Bot" | |
| 00401B5F UNICODE "SYSTEM" | |
| 004026B7 UNICODE "KEY" | |
| 004028F8 UNICODE "listed" | |
| 004028FD UNICODE "DNSBL" | |
| 00402904 UNICODE "not listed" | |
| 00402909 UNICODE "DNSBL" | |
| 00402CDE UNICODE "%s %s" | |
| 00402D86 UNICODE "spk" | |
| 00403057 UNICODE ".tmp" | |
| 00403111 UNICODE "tmp" | |
| 00403156 UNICODE "tmp" | |
| 004031BA UNICODE ".tmp" | |
| 00403341 UNICODE "config.conf" | |
| 0040342E UNICODE "user" | |
| 00403616 UNICODE "%s \"%s\"" | |
| 00403765 UNICODE "config.conf" | |
| 004037C2 UNICODE "CONFIG" | |
| 00403910 UNICODE "group_tag" | |
| 00403940 UNICODE "group_tag" | |
| 00403AE1 UNICODE "%s start" | |
| 00403B5E UNICODE "%s %s" | |
| 00403C96 UNICODE "%s.%s" | |
| 00403D90 UNICODE "%s.%s.%s.%s" | |
| 00403FF6 UNICODE "mcconf" | |
| 00404095 UNICODE "ver" | |
| 004040B8 UNICODE "gtag" | |
| 004040EF UNICODE "servs" | |
| 0040410B UNICODE "autorun" | |
| 004042B9 UNICODE "module" | |
| 004042D7 UNICODE "name" | |
| 004042EB UNICODE "ctl" | |
| 00404540 UNICODE "srv" | |
| 00404772 UNICODE "ECDSA_P384" | |
| 00404796 UNICODE "ECCPUBLICBLOB" | |
| 004047BA UNICODE "SignatureLength" | |
| 00404E2F UNICODE "GET" | |
| 00404E7E UNICODE "1011" | |
| 00404E9A UNICODE "TrickLoader" | |
| 0040542A UNICODE "/%s/%s/0/%s/%s/%s/%s/%s/" | |
| 004055A6 UNICODE "/%s/%s/1/%s/" | |
| 00405730 UNICODE "/%s/%s/5/%s/" | |
| 004058AF UNICODE "/%s/%s/10/%s/%s/%d/" | |
| 00405A06 UNICODE "/%s/%s/14/%s/%s/0/" | |
| 00405B4C UNICODE "/%s/%s/23/%d/" | |
| 00405CEC UNICODE "/%s/%s/25/%s/" | |
| 00405EE7 UNICODE "%s/%s/63/%s/%s/%s/%s/" | |
| 00405F08 UNICODE "POST" | |
| 00406045 ASCII "------Boundary%08X" | |
| 0040605B UNICODE "------Boundary%08X" | |
| 00406073 ASCII "--%s\r\nContent-Disposition: form-data; name=\"noname\"\r\n\r\n" | |
| 0040608F ASCII "\r\n--%s--\r\n" | |
| 004060CC UNICODE "Content-Type: multipart/form-data; boundary=%s\r\nContent-Length: %d\r\n\r\n" | |
| 004060F7 ASCII "%s" | |
| 00406321 UNICODE "tmp" | |
| 00406616 UNICODE "No params" | |
| 00406670 UNICODE "Win32 error" | |
| 00406698 UNICODE "Decode from BASE64 error" | |
| 004066CE UNICODE "Unable to load module" | |
| 004066E9 UNICODE "Win32 error" | |
| 00406704 UNICODE "Win32 error" | |
| 00406727 UNICODE "GetParentInfo error" | |
| 0040673B UNICODE "start" | |
| 0040675B UNICODE "Unable to launch module" | |
| 00406777 UNICODE "Process was unloaded" | |
| 00406795 UNICODE "Unable to launch module" | |
| 004067B3 UNICODE "Unable to launch module" | |
| 004067EB UNICODE "Start failed" | |
| 004067FA UNICODE "release" | |
| 00406811 UNICODE "Module already unloaded" | |
| 0040682F UNICODE "Process has been finished" | |
| 0040686B UNICODE "Module was unloaded" | |
| 00406884 UNICODE "Process has been finished" | |
| 004068C5 UNICODE "Control failed" | |
| 00406914 UNICODE "Win32 error" | |
| 0040694C UNICODE "Invalid params count" | |
| 00406B5C UNICODE "%02X" | |
| 00406BF8 UNICODE "client_id" | |
| 00406CA0 UNICODE "%s_W%d%d%d." | |
| 00406D64 UNICODE "client_id" | |
| 00406F7B UNICODE "GET" | |
| 00407035 UNICODE "0.0.0.0" | |
| 004072C1 UNICODE "\r\n" | |
| 00407564 UNICODE "\r\n" | |
| 00407887 UNICODE "servconf" | |
| 00407918 UNICODE "expir" | |
| 0040793D UNICODE "plugins" | |
| 00407B06 UNICODE "psrv" | |
| 00407CDB UNICODE "*.*" | |
| 00407ED0 ASCII "GetNativeSystemInfo" | |
| 00407ED5 UNICODE "kernel32.dll" | |
| 00407F0E UNICODE "Windows 10 Server" | |
| 00407F18 UNICODE "Windows 10" | |
| 00407F37 UNICODE "Windows Server 2012 R2" | |
| 00407F41 UNICODE "Windows 8.1" | |
| 00407F52 UNICODE "Windows Server 2012" | |
| 00407F59 UNICODE "Windows 8" | |
| 00407F69 UNICODE "Windows Server 2008 R2" | |
| 00407F70 UNICODE "Windows 7" | |
| 00407F80 UNICODE "Windows Server 2008" | |
| 00407F87 UNICODE "Windows Vista" | |
| 00407F9E UNICODE "Windows Server 2003" | |
| 00407FA9 UNICODE "Windows XP" | |
| 00407FB4 UNICODE "Windows 2000" | |
| 00407FBB UNICODE "Unknown" | |
| 00407FCA UNICODE "x64" | |
| 00407FD1 UNICODE "x86" | |
| 0040800A UNICODE "%s %s SP%d" | |
| 00408022 UNICODE "%s %s" | |
| 00408071 UNICODE "Ncrypt.dll" | |
| 00408085 UNICODE "Bcrypt.dll" | |
| 004080A4 ASCII "NCryptOpenStorageProvider" | |
| 004080BF ASCII "NCryptImportKey" | |
| 004080DA ASCII "NCryptDeleteKey" | |
| 004080F4 ASCII "NCryptFreeObject" | |
| 0040810F ASCII "BCryptOpenAlgorithmProvider" | |
| 00408126 ASCII "BCryptImportKeyPair" | |
| 0040813C ASCII "BCryptGetProperty" | |
| 00408153 ASCII "BCryptVerifySignature" | |
| 0040816A ASCII "BCryptCloseAlgorithmProvider" | |
| 00408180 ASCII "BCryptDestroyKey" | |
| 0040822A UNICODE "Wininet" | |
| 00408246 ASCII "InternetCanonicalizeUrlW" | |
| 00408A39 UNICODE "%s%s" | |
| 00408B34 UNICODE "Microsoft Software Key Storage Provider" | |
| 00408B55 UNICODE "ECCPUBLICBLOB" | |
| 00408ECE UNICODE "Modules\\" | |
| 00408EEC UNICODE "%s%s_configs\\" | |
| 00408F6E UNICODE "%s%s" | |
| 00409320 ASCII "<moduleconfig>*</moduleconfig>" | |
| 00409349 ASCII "<moduleconfig>*</moduleconfig>" | |
| 00409544 UNICODE "autostart" | |
| 00409554 UNICODE "yes" | |
| 0040956D UNICODE "processname" | |
| 004095A4 UNICODE "autoconf" | |
| 004095C0 UNICODE "autocontrol" | |
| 004095DC UNICODE "needinfo" | |
| 004097A3 UNICODE "control" | |
| 004097CD UNICODE "ctl" | |
| 004097E4 UNICODE "arg" | |
| 00409981 UNICODE "conf" | |
| 004099AF UNICODE "ctl" | |
| 004099C3 UNICODE "file" | |
| 004099D5 UNICODE "period" | |
| 00409B04 UNICODE "name" | |
| 00409B16 UNICODE "id" | |
| 00409B32 UNICODE "ip" | |
| 00409B4E UNICODE "parentfiles" | |
| 0040A220 ASCII "Start" | |
| 0040A238 ASCII "Control" | |
| 0040A253 ASCII "FreeBuffer" | |
| 0040A26E ASCII "Release" | |
| 0040A94F UNICODE "svchost.exe" | |
| 0040A9A1 UNICODE "svchost.exe" | |
| 0040ABE1 ASCII "SignalObjectAndWait" | |
| 0040ABE6 UNICODE "kernel32" | |
| 0040ABFD ASCII "WaitForSingleObject" | |
| 0040AC02 UNICODE "kernel32" | |
| 0040AC13 ASCII "CloseHandle" | |
| 0040AC18 UNICODE "kernel32" | |
| 0040AC29 ASCII "ResetEvent" | |
| 0040AC2E UNICODE "kernel32" | |
| 0040AC3F ASCII "ExitProcess" | |
| 0040AC44 UNICODE "kernel32" | |
| 0040AF77 ASCII "LoadLibraryW" | |
| 0040AF7E UNICODE "kernel32" | |
| 0040B026 ASCII "GetProcAddress" | |
| 0040B02B UNICODE "kernel32" | |
| 0040B7FF UNICODE "Modules\\" | |
| 0040B820 UNICODE "%s%s_configs\\" | |
| 0040B847 UNICODE "%s%s" | |
| 0040BB60 UNICODE "Modules\\" | |
| 0040BB8D UNICODE "Modules\\" | |
| 0040BB9F UNICODE "Modules\\" | |
| 0040BBAC UNICODE "Modules\\" | |
| 0040BDD3 UNICODE "Modules\\" | |
| 0040C5E0 UNICODE "32" | |
| 0040C5E6 UNICODE "%s%s" | |
| 0040C62C UNICODE "Modules\\" | |
| 0040C631 UNICODE "%s%s" | |
| 0040C721 UNICODE "Modules\\" | |
| 0040CADE UNICODE "D:(A;;GA;;;WD)(A;;GA;;;BA)(A;;GA;;;SY)(A;;GA;;;RC)" | |
| 0040CAFF UNICODE "Global\\TrickBot" | |
| 0040CBCB UNICODE "ssert" | |
| 0040CC4A UNICODE "expir" | |
| 0040CDC0 UNICODE "BotLoader" | |
| 0040CE03 UNICODE "GET" | |
| 0040CE1F UNICODE "GET" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment