MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206
SHA3-384 hash: df915a5f6ad66728c7d98bf5712d6de993eeecec4c5ea5f9ee9d7518672064a2b56317459bedb8a5317ef0a9f56fba4e
SHA1 hash: 062df3ca98d057248803198cf8271c6c7da1d067
MD5 hash: 515734aa971a30fbb64e049658ac634d
humanhash: mike-delta-three-tennis
File name:515734aa971a30fbb64e049658ac634d.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:453'120 bytes
First seen:2021-10-27 12:22:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ea5a56b411909a74a5afb4f0920c62b1 (4 x TrickBot)
ssdeep 6144:om18XMqwPrNX4escDPAnEPg6sUZW36Ieowa4U5NwLXBHijV:h1r1rNX4eFDPxPxsv3IL/U5GXdijV
Threatray 4'207 similar samples on MalwareBazaar
TLSH T1C9A4F1207085C472E5B325758DF597A58B2DF8704B6864CBB7C80ABE0F7A5E1EA38317
File icon (PE):PE icon
dhash icon 115060f4f0f972b0 (4 x TrickBot)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
279
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/200523/
Detection(s):
SecuriteInfo.com.Variant.Zusy.405052.10049.23670.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/617944809a5a1e91c5d7242d/reports/32a3d6c9-dbd0-4e01-ac46-3ddbf23f73df/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b8f8c2e-0c5c-4f29-8bbd-89a9e7ce8e2c
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/877719
Signature
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206/
Threat name:
Win32.Spyware.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 12:23:04 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
3816e3845184a41e9c7a1bcb9dacd089e712f72fff6f44ab4d55d563b0177652
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
473dfbecc3818114569a9a9f80b0a51ad74b3d88fa778158ab145e839ecb042c
TrickBot
5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2
TrickBot
784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e
TrickBot
b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de
TrickBot
c9a17531e2ae6361f893390f51295609f4a2fde60927a9afeac9a9e0c4fc2660
TrickBot
ffaa54fe26b7cb4b86bdb7d49a5b2e609cffdc3c3db9460a77f074b503988504
TrickBot
+ 4'197 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:top141 banker trojan
Link:
https://tria.ge/reports/211027-pjxjhaega3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
6cbd5f982e1441a45d1da7741f0d8d8704772761f3feaa7447894d28a7fbfd57
MD5 hash:
5eca5deb8a7814148e03d82e84ea71f8
SHA1 hash:
9618d6ede28890095fbf6b640d93730da4b7727f
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8bc19ae7-697d-422c-ae2f-70d5b02791c2/
SH256 hash:
074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206
MD5 hash:
515734aa971a30fbb64e049658ac634d
SHA1 hash:
062df3ca98d057248803198cf8271c6c7da1d067
Link:
https://www.unpac.me/results/8bc19ae7-697d-422c-ae2f-70d5b02791c2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/074870cf4c7b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1698136/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/200523/

Comments