MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1061ec89b5ba14eb88f514006fa49d33217e711d6e3440b6c0811ee990aaff4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	1061ec89b5ba14eb88f514006fa49d33217e711d6e3440b6c0811ee990aaff4e
SHA3-384 hash:	8fda90ec17d8ac403b4df63e8147ff90fac7fc479a6423ce5c4356faef0a5000c1dbf211cf592cc18d6195658f998bf0
SHA1 hash:	746d098d41ce4829d4ce51d2a79dff15eabde560
MD5 hash:	1479d872da052b835c36778a3764c197
humanhash:	two-aspen-november-eleven
File name:	9EYJSFYHMS.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	765'957 bytes
First seen:	2020-05-05 04:42:36 UTC
Last seen:	2020-05-05 17:24:48 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	30625d671f2d3abf2a3e2df54581f47b (312 x TrickBot)
ssdeep	12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwya:grdO+tDKFQoNOml1
Threatray	4'788 similar samples on MalwareBazaar
TLSH	60F4B32F8EBC4E13E5D4C2F03E368E5CA6D65C19F84C65AE53043E8A2E637322D5456E
Reporter	JoulK
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

100

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.20ee34e01ac25807.25233.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-05 01:14:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 31 (90.32%)

Threat level:

2/5

Verdict:

malicious

Label(s):

trickbot

TrickBot

0efd127265c4ca52772afbf277ae95cd3f47155088104f8bb3c27f339a5e177e

TrickBot

16f74973aeb99c37d5052e1378a6b12d152429c5c51e28b6586f7a4d06569d9d

TrickBot

194ada12dc0e6f0e4b19749462adcb010e3c02b207f2aa80dd630a4b45b94052

TrickBot

1a8b219afaf377371abec2f600e8d4603b921f9a1c9d32a4cf01aa5ac9329048

TrickBot

22afddb179a5d675a11ef6cc90e40d0a84cf33bc8efb1f9b70830e32cbabf092

TrickBot

518c26e1e9fa469f566d922a634568caec917062a0e37b890d58a9dd5cdd9dae

TrickBot

6dee5907e6d007cc2dc812b55861636e8f75cbf5dbdc3f08f0316309072ac6f0

TrickBot

c1cfebf99679e42a7b770ba32df3ce4f604e54e7efce2c9bf1d44722e6187d06

TrickBot

cd31a5e5231ecc94a7e37452cac4e0c441f8d76b53d5380676e410c867fb46d8

TrickBot

+ 4'778 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:ono41 banker trojan

Link:

https://tria.ge/reports/201109-avwca7vmd6/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Trickbot

Malware Config

C2 Extraction:

5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449

Please note that we are no longer able to provide a coverage score for Virus Total.