MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181
SHA3-384 hash: b3381dec78bc02fcfda899b0a8ed1ae012fd66640eeb994cabc907365c048e07a6440e69744afd7f8818ba1d12710627
SHA1 hash: 4c181eccee61c9ebda048a3f61ca584fe82d580a
MD5 hash: 4c40eaccca95dcdd80f22a9bd58a81f8
humanhash: artist-bluebird-uranus-queen
File name:4c40eaccca95dcdd80f22a9bd58a81f8.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:692'267 bytes
First seen:2021-10-29 05:18:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7ffe85aa6061465054775c61556ce3a7 (3 x TrickBot)
ssdeep 12288:azhK0hnJrYs840+8xZFDuJsd3aaTW/cTG6QCepwl/Cxofh/zB:HQrYs8v+8xbs/qveiCxofh/l
Threatray 4'212 similar samples on MalwareBazaar
TLSH T1E3E4DF613BC1C1B7E6B201750FE63B35A2BBE9A00F31BBC367849B4C5A318D15A35756
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Agent.FPBV.20685.21165.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2e4a616d-cf34-44a2-8283-d94469b4c635
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879067
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 22:58:56 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941
TrickBot
061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565
TrickBot
074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206
TrickBot
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
TrickBot
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
TrickBot
784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e
TrickBot
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
TrickBot
+ 4'202 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:top142 banker suricata trojan
Link:
https://tria.ge/reports/211029-fzt9mshdaq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
702e79f0e95f0d00d2124852fa5543df72f81b8156a29ac2ae3f24a0b26faf00
MD5 hash:
fcca7ac5ed3b2d6a3bcf0bd6dd161224
SHA1 hash:
d5a00f79760902e325d51c6ae29786f052f7788b
Link:
https://www.unpac.me/results/42db3530-3a4e-4484-92ac-5a37d5820c34/
SH256 hash:
ba29047807365df77d563d3de7d7afbbadc825659f5c225737733acbb9a7d958
MD5 hash:
206a8071442e26de0c0a1dc6db6c6d7f
SHA1 hash:
2ba3f64eae7f554bae8568e35bc67ef784771eac
Link:
https://www.unpac.me/results/42db3530-3a4e-4484-92ac-5a37d5820c34/
SH256 hash:
18e6c9796b136c39c9673b63c89d0e9c4961596d55803f3a35db8279a2ea8c44
MD5 hash:
872f89d8a006f51920fdb7ba25e665ce
SHA1 hash:
1dcb06d08c3853a89a0f22523e44a719118edd31
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/42db3530-3a4e-4484-92ac-5a37d5820c34/
SH256 hash:
1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181
MD5 hash:
4c40eaccca95dcdd80f22a9bd58a81f8
SHA1 hash:
4c181eccee61c9ebda048a3f61ca584fe82d580a
Link:
https://www.unpac.me/results/42db3530-3a4e-4484-92ac-5a37d5820c34/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1309cc563fba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1698136/
  
Delivery method
Distributed via web download

Comments