MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09de3bac2c4cde6fa2a7e2539365a6f225d17683ad478f00203c5a538b1e43ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	09de3bac2c4cde6fa2a7e2539365a6f225d17683ad478f00203c5a538b1e43ae
SHA3-384 hash:	ffab6b215678ab381c9570bf4c63866b3472f052e11051a85308f1e1586207030eb01c5dda1ae4f0ddd3609d811a66b2
SHA1 hash:	fc8edec7f21916c064ea51d262b7bc25cd169111
MD5 hash:	c40b54924a6dc58beed0021ea5e6a535
humanhash:	monkey-black-indigo-july
File name:	3889cddst.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	338'627 bytes
First seen:	2020-08-06 09:41:03 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4a8c5544cd24df05aabef0164d767361 (413 x TrickBot)
ssdeep	6144:C12iazhHebQnUuPYhVY0YNrkcPdN09Qj8uytOItBwfwzvsmI3WEaCoqNSoIDcTfA:C12tuQPPwYycd0iKDwCv01oqNS1DcTfA
Threatray	978 similar samples on MalwareBazaar
TLSH	8374F102E5C74C3AD2656435063D3971DAB8DF1417BD9B2376C8C96B2899888DF3EB0B
Reporter	JAMESWT_WT
Tags:	TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

161

Origin country :

n/a

Vendor Threat Intelligence

Detection:

TrickBot

Link:

https://www.capesandbox.com/analysis/40888/

Detection(s):

SecuriteInfo.com.Variant.Zusy.310686.15496.3744.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Sending a UDP request

Delayed writing of the file

Deleting a recently created file

Launching a process

Connecting to a non-recommended domain

Connection attempt

Unauthorized injection to a system process

Result

Threat name:

Trickbot

Detection:

malicious

Classification:

troj.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/413519

Signature

Allocates memory in foreign processes

Delayed program exit found

Found malware configuration

Machine Learning detection for sample

May check the online IP address of the machine

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09de3bac2c4cde6fa2a7e2539365a6f225d17683ad478f00203c5a538b1e43ae/

Threat name:

Win32.Trojan.TrickBot

Status:

Malicious

First seen:

2020-08-06 00:07:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bhpdxlbmjtpg7ivh4jjzgzng6is5c5udvvdy6abahrnfhcy6ioxa._file

Verdict:

unknown

Result

Malware family:

trickbot

Score:

10/10

Tags:

dave trojan banker family:trickbot

Link:

https://tria.ge/reports/200806-crt5k1c98s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Dave packer

Trickbot

Malware Config

C2 Extraction:

51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Tinba

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/09de3bac2c4cde6fa2a7e2539365a6f225d17683ad478f00203c5a538b1e43ae