MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
SHA3-384 hash: 379e9e0bf16ca7d80ea82308c0bbcc062f2c00fc910e09a9ee9cd9ed144fececc50a16982ec199edb1ef8ceb2bb685d6
SHA1 hash: b36cb812850b41394bb50172faddb44ade00fcdf
MD5 hash: 842590a5c639634c2ab40919616fb7f0
humanhash: september-india-papa-mike
File name:126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
Download: download sample
Signature TrickBot
Create hunting rule
File size:614'400 bytes
First seen:2020-11-15 23:21:59 UTC
Last seen:2020-11-16 00:42:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8d30e57c6a35a6f8994c5967f3d6d712 (4 x TrickBot)
ssdeep 12288:gZBfWwcRr/Sj2Q0rGpWygb2xglS/ORfEGT9cpPFTj:egyzxglSVy2pPFTj
Threatray 2'896 similar samples on MalwareBazaar
TLSH FAD46C135DAD65E0E15205305E3A5F65283BBC263850EA4BD7A0BD6CE873783E8B532F
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
328
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed.140.4110.12963.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Connection attempt
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/536691
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 23:26:20 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
2f84b8a85106e702ca8a3b71db94b1dc8dda5173e9e7b1f672b28c07d37f57ed
TrickBot
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
TrickBot
58c4bea082b2f44f0beab5356ae2bc9bc73c3f13ab0491861bc2ba24690da103
TrickBot
6ca141e8ed2443113c9e497d231b93cf41d86b224993c48f589b375a830cd27c
TrickBot
84f007e1e974a8305c3406d47d3430812f1805974f582cf2230bdf03f2c33269
TrickBot
bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16
TrickBot
e8b03d2e2f16d44d8ce2272bb7f19c80c3006215b00624c79c204c70f54d1d83
TrickBot
ea5c72bce7e028a6b2f9febd90751bf0e323da00b4b0d68be2a52ed21fe2a4d0
TrickBot
f5ead975f27590c7aa8e191ea9e413597542e0a665e6641f27e9011a18b3a4b5
TrickBot
fbb4e4339bbb0bce98f6de368a927d77cfcd15067f178d80f626da35f9a08981
TrickBot
+ 2'886 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib7 banker trojan
Link:
https://tria.ge/reports/201115-wakft648gn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Trickbot
Malware Config
C2 Extraction:
202.136.89.226:449
202.169.244.252:449
203.176.135.38:449
212.3.104.50:449
41.203.215.122:449
41.41.179.239:449
43.239.152.240:449
43.242.141.59:449
43.245.216.190:449
43.255.113.180:449
45.230.8.34:449
45.233.25.6:449
78.138.128.20:449
49.156.41.74:449
Unpacked files
SH256 hash:
126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
MD5 hash:
842590a5c639634c2ab40919616fb7f0
SHA1 hash:
b36cb812850b41394bb50172faddb44ade00fcdf
Link:
https://www.unpac.me/results/af24d464-6066-4cec-b527-599ba335baec/
SH256 hash:
94bb78c963483f90f3edd840cbb845fa6a23ba65b7b3b1519af3432b6ee79492
MD5 hash:
0db60dd4052f640cd76dc75f318bce80
SHA1 hash:
b4cf31f0e772fef640c553a9c813ede2736df205
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/af24d464-6066-4cec-b527-599ba335baec/
SH256 hash:
e4ffade6a267935b4f699cbe9de7b4d716edb735f3fd52434dc7c62c0aa570ff
MD5 hash:
949ffd4f39b63905165149fdfbc2a855
SHA1 hash:
1269c4afeaa03297558e3e793a624885eff46daa
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/af24d464-6066-4cec-b527-599ba335baec/
Parent samples :
7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments