MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 13aa0fdd60e89711b5218497c7264c2ac11553ea7034f646c922fa47e8732928. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 12
| SHA256 hash: | 13aa0fdd60e89711b5218497c7264c2ac11553ea7034f646c922fa47e8732928 |
|---|---|
| SHA3-384 hash: | 1ba253fbe43e93a68e6478739d26c484f16b5fcb1065fb401876d318849639abe1d237f75f39389996dbd36aadf12d5f |
| SHA1 hash: | 725a6d94d504482804688448778cee7c9934b3b9 |
| MD5 hash: | 3e58335fd953073ae4918f70a27ab929 |
| humanhash: | ink-ack-network-social |
| File name: | 3e58335fd953073ae4918f70a27ab929.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 466'944 bytes |
| First seen: | 2021-03-24 07:36:51 UTC |
| Last seen: | 2021-03-24 09:55:40 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 55084870e14c8f3b289a5358885b34e6 (5 x TrickBot) |
| ssdeep | 6144:34DNLCVe+nSUIo0ML1T/oK1bgAyxZ/bmTcO59xwnQV8htFzs+LnzQVXY:wNLCVeepIoH1zkaT7B7mFA+7Md |
| Threatray | 666 similar samples on MalwareBazaar |
| TLSH | 6CA43A32F6981637E26A50B27FB58120B56F98B428319833924F5D4D277BE935E9033F |
| Reporter |  abuse_ch |
| Tags: | exe TrickBot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3e58335fd953073ae4918f70a27ab929.exe
Verdict:
Malicious activity
Analysis date:
2021-03-24 08:12:17 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Launching a process
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Detection:
malicious
Classification:
evad.troj
Score:
92 / 100
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.Bsymem
Status:
Malicious
First seen:
2021-03-24 07:37:06 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 656 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:tot66 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
174.105.236.140:443
67.79.117.70:443
162.155.225.130:443
70.235.74.189:443
72.164.254.204:443
173.219.76.169:443
98.6.253.142:443
137.27.167.58:443
24.182.101.64:449
50.208.68.153:443
67.212.241.127:443
99.147.197.147:443
216.186.128.26:443
174.105.233.82:443
70.119.220.241:443
70.125.241.196:443
24.153.175.236:443
96.68.79.18:443
75.87.15.158:443
47.190.2.12:443
72.180.57.176:443
173.198.151.86:443
47.51.219.98:443
162.155.10.150:443
162.155.69.74:443
71.15.77.155:443
67.79.117.70:443
162.155.225.130:443
70.235.74.189:443
72.164.254.204:443
173.219.76.169:443
98.6.253.142:443
137.27.167.58:443
24.182.101.64:449
50.208.68.153:443
67.212.241.127:443
99.147.197.147:443
216.186.128.26:443
174.105.233.82:443
70.119.220.241:443
70.125.241.196:443
24.153.175.236:443
96.68.79.18:443
75.87.15.158:443
47.190.2.12:443
72.180.57.176:443
173.198.151.86:443
47.51.219.98:443
162.155.10.150:443
162.155.69.74:443
71.15.77.155:443
Unpacked files
SH256 hash:
7692ea1ddf50f55bef032879736f7f313309c265a0a6b4eb1ec9dac7a01a0640
MD5 hash:
18e19e84fa726826258eed6531a475e4
SHA1 hash:
36c3fd1924f9c9b770709d62fb4d5202a3b2deb4
Detections:
win_trickbot_a4
win_trickbot_auto
Parent samples :
b039634cd9719da110e0453ed4f668af7f7de7509bafa9205ae147e8aa1c1896
389ec465ec5038ddb8eaa907961d5602fb23bab039b4f262151526331e15b4bc
13aa0fdd60e89711b5218497c7264c2ac11553ea7034f646c922fa47e8732928
bc8073c4f97ff572812e0a0b0603899223b17eb4f37f02b640848edaff36c981
85cfd42faa485da7e37e87c96a7e19206531a19a37f5cc3edfebd21b5d47d407
389ec465ec5038ddb8eaa907961d5602fb23bab039b4f262151526331e15b4bc
13aa0fdd60e89711b5218497c7264c2ac11553ea7034f646c922fa47e8732928
bc8073c4f97ff572812e0a0b0603899223b17eb4f37f02b640848edaff36c981
85cfd42faa485da7e37e87c96a7e19206531a19a37f5cc3edfebd21b5d47d407
SH256 hash:
ef9d5f416ce0f8e0cbe37a75ff036427f251419e253277b7d33bd69c811695a9
MD5 hash:
ac094aeb25db6de948a4f91e86e884a7
SHA1 hash:
f7774fbb6ccf0b68978cb6b80fac42b9e3de775c
Detections:
win_trickbot_auto
SH256 hash:
13aa0fdd60e89711b5218497c7264c2ac11553ea7034f646c922fa47e8732928
MD5 hash:
3e58335fd953073ae4918f70a27ab929
SHA1 hash:
725a6d94d504482804688448778cee7c9934b3b9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.