MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53e3fa4c1b8f8ae4a3477a70535d4f1c402de87c47c2f906d8a2600f8ba58b4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53e3fa4c1b8f8ae4a3477a70535d4f1c402de87c47c2f906d8a2600f8ba58b4a
SHA3-384 hash: 15bfa336cbfd7f430ac1a2bc78a816eb58bc7129bb6383fc92d21630ed8a22e28b4a71c6e7a69c77160c2b28b35bf145
SHA1 hash: 94ad76e66fab0d30edeedc526dd8130a6a3812e1
MD5 hash: a68ddd0e9ad53703b6f55ff9931ccc20
humanhash: yankee-princess-march-wyoming
File name:53e3fa4c1b8f8ae4a3477a70535d4f1c402de87c47c2f906d8a2600f8ba58b4a
Download: download sample
Signature TrickBot
Create hunting rule
File size:917'597 bytes
First seen:2020-06-03 15:02:05 UTC
Last seen:2020-06-03 15:04:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0424cdffeca1b1f193db58af03b4f16b (1 x TrickBot)
ssdeep 24576:tbzEVW8CfXP5hPUu8meJ/Wb3wI9jdEgp28zTl:QCffimeZIrjJ
Threatray 2'990 similar samples on MalwareBazaar
TLSH 3015AE63359A843AD7B301F18DA66B3592AA9E204F356AC313CC4F5F0B755C29D323A7
Reporter raashidbhatt
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
4
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-05-30 02:01:00 UTC
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpr7uta3r6foji2hpjyfgxkpdrac32d4i7bpsbwyujqa7c5frnfa._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
trickbot
Create hunting rule
Similar samples:
236f41663de2ee5f3acb847d16c89e2f496b0dba220cf01b5f3fbaf686e7b094
TrickBot
45eb4fc349af6db90f7938853326c0b6f7ce4c2119bb873a449a0128dc1cc370
TrickBot
546ba5ce0a83d3dbc31ee21e174438c9e3794834de8d11a47f04f1ce005cd67d
TrickBot
a0ab7c82f1f4e27192e6b3bef72275bb815dbb24c2d27d02a06ea6862546e7d6
TrickBot
a49a095ec2f03a00358f4874acf3d574d0d582a52065d1f597d9d83b0eea93ff
TrickBot
ccdc04adce0627519bf39c6491765a6c61b1ee62e188e4a329aee529623c92b8
TrickBot
d494077303e7a373e64379d2b7bb80695809d3c9c64c993d324775f33d8b798a
TrickBot
df3ed6d4a2ea8d6ae3d1ab87ba9654b438e36d0276e2dfcdbc9dbe689413a3d8
TrickBot
e94e31beaf1c2a6c24f0973a621c8715faf91a18e8c7acdab8a832021c7ce5f5
TrickBot
f4001d5fcb0c67c66b6c2df8f1b1bf173b9b25277c72916105b424137bc90a9b
TrickBot
+ 2'980 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib683 banker dave trojan
Link:
https://tria.ge/reports/201109-ymggvt93ba/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Loads dropped DLL
Dave packer
Executes dropped EXE
Trickbot
Trickbot x86 loader
Malware Config
C2 Extraction:
5.182.210.226:443
185.62.188.10:443
185.252.144.190:443
92.223.93.153:443
51.89.115.99:443
89.32.41.126:443
5.255.96.153:443
94.156.35.216:443
80.87.195.21:443
5.34.176.184:443
62.109.1.7:443
212.80.216.181:443
5.182.210.120:443
194.5.250.166:443
185.14.30.209:443
51.89.115.103:443
85.204.116.179:443
194.5.250.168:443
190.214.13.2:449
181.140.173.186:449
181.129.104.139:449
181.113.28.146:449
181.112.157.42:449
170.84.78.224:449
200.21.51.38:449
46.174.235.36:449
36.89.85.103:449
181.129.134.18:449
186.71.150.23:449
131.161.253.190:449
200.127.121.99:449
114.8.133.71:449
119.252.165.75:449
121.100.19.18:449
202.29.215.114:449
180.180.216.177:449
171.100.142.238:449
186.232.91.240:449
181.196.207.202:449
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments