MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99
SHA3-384 hash: b71331c57faaba5fb8c87208615c8c13743fb25d97306450b2ce48ce02c321983e13d4056d75984bd3875706a50c9b9e
SHA1 hash: 363fa0ff3b3bccb2f1dfea5e8b014e8992edd4a7
MD5 hash: 734447612a5a160f9f5f0607a348984c
humanhash: blue-yellow-five-fix
File name:734447612a5a160f9f5f0607a348984c.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:725'055 bytes
First seen:2021-11-16 21:13:39 UTC
Last seen:2021-11-16 23:02:50 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b1583b0de68b5707a7d41293f45591df (9 x TrickBot)
ssdeep 12288:RrWHBIB7EQKzTBS+FrmAlK3wg5MQrhhTXYxZp:UBIp88uSIKgl2hTIh
TLSH T164F4E15232F4807BE5BB92720FA6673A97BBAC644B71B6C713A0935D8D310C14D39B27
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
679
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/206662/
Detection(s):
SecuriteInfo.com.Trojan.Trick.46918.3559.30562.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Launching a process
DNS request
Sending a custom TCP request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/61941f2243e8f62b6695e6eb/reports/df785ae4-b185-42c1-9340-2c4d25c62fdc/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/86735336-d92c-4800-8860-e05ccf4cc2bd
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/890758
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-16 21:14:11 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cfjy2m6iojlqtkzekl5sozqiskwjihq6qk35phj7ggancidczsmq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lip148 banker trojan
Link:
https://tria.ge/reports/211116-z3ccsafed9/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
544f7841dd6cb81942ee90790b3716f75e8e73b4e0b5090c1cacf72604477746
MD5 hash:
22280b87ee209e23f0dd684aa4397c22
SHA1 hash:
b148fe19dc4d7e39bad6b9a56fdee2f8376cbea6
Link:
https://www.unpac.me/results/f843324a-78c5-40f3-88e7-f424b937047e/
SH256 hash:
cbce04d470c17f27db6be44fa560064f333a398f688456ba1df109549d3747f9
MD5 hash:
ce7d54dd3331fd8a8a49f616c798cdf0
SHA1 hash:
a702590642147e5ffedab92c566d66aecb21254e
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f843324a-78c5-40f3-88e7-f424b937047e/
Parent samples :
0dae9c7dcbe72dc89267a3a8d7ad2a138fc0c0921709170353d2646952e859ba
0c465bf1b390d7c7021b6d77afba91c59609727bfc7f351d90e20f0a76240cb4
11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99
SH256 hash:
ef22d4752208d4b13d8c6563946346c1933bb6d669543115038d896e90412ed7
MD5 hash:
dfbe1fafecbd547ee7b5bee53feda127
SHA1 hash:
cd934206b9e4a42b934112c997b9d25d4ccd3cf6
Link:
https://www.unpac.me/results/f843324a-78c5-40f3-88e7-f424b937047e/
SH256 hash:
11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99
MD5 hash:
734447612a5a160f9f5f0607a348984c
SHA1 hash:
363fa0ff3b3bccb2f1dfea5e8b014e8992edd4a7
Link:
https://www.unpac.me/results/f843324a-78c5-40f3-88e7-f424b937047e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/11538d33c872/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 11538d33c8725709ab2452fb27660892ac941e1e82b7d79d3f3180d12062cc99

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1790355/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/206662/

Comments