MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54
SHA3-384 hash: 03ced25272b4c304b4dfccf9a25855d8b5cd20df462df5bfb5444d7a163bc30f2c1120722f58d96c20d23fad93b1cc5d
SHA1 hash: 4cf4bcdc2860577c204056fd24dc55c025102c25
MD5 hash: 1b44d7f9a351214acd55379f24658089
humanhash: social-cardinal-quebec-potato
File name:1b44d7f9a351214acd55379f24658089.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:753'664 bytes
First seen:2021-10-07 09:08:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0f4296a776e183d43c9748b7869d4228 (9 x TrickBot)
ssdeep 12288:vJMtObg6CM2wUbyh/pSRNlW96QZk6BSb9XQox4e6oqu:vTbxCM2rc/+sL/Bo9XQ64f/u
Threatray 3'916 similar samples on MalwareBazaar
TLSH T105F4AE0631D0E1BAD5E321B4CED1EB3956F9DD9287290BCB6B81F91E6E326C0453B712
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe lib159 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1b44d7f9a351214acd55379f24658089.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-07 09:51:25 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6c79ad1e-17db-4a02-ac6f-24917c0b30de

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195767/
Detection(s):
Win.Malware.Generic-9899480-0
Create hunting rule

Win.Malware.Generic-9899481-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware1.10961.12896.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/615eb8f9b95458900cddf81b/reports/9c553ad9-5e53-491f-aae7-201d60a1330e/overview
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/866196
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-06 11:37:47 UTC
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=djksnj6gkr4oqpkdqau6ge5pvbjazof5ik723psv5iayceven5ka._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
TrickBot
3cff8842d7b2da479a8dcd6c930706d2df7550f9931cefdc94979f03d256f718
TrickBot
474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1
TrickBot
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
TrickBot
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
TrickBot
6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19
TrickBot
728aff0d54df55bd4ed10a1c02c165e86310503cf82bd4c2d6b4b2a0a383dabd
TrickBot
790769e6e3eb9d2d5d70b03c8d5e0728e954a2bcdd3625b87fd3366b961b90a7
TrickBot
9ef22f6e73a5eae7a8d1f9fb682e18a413d3081f418238ad16c682d662fb12e9
TrickBot
acf725f1ade6bcadcb9f0ded2d0ad8e6cac553a19acbaf67dd95c133623594e4
TrickBot
+ 3'906 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib159 banker trojan
Link:
https://tria.ge/reports/211007-k3x7xscddq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
fd752504562267f2e4753884fb70852bc424973ef6ca377fe393adbfe3612555
MD5 hash:
a15a407ae0533a8329c0e5d196ee5c04
SHA1 hash:
948db2b94d7fec0108eda19aa0c23268932d1c4d
Link:
https://www.unpac.me/results/33c40eb9-2658-4ecb-99da-079814968449/
SH256 hash:
23552087f88bd9eaf2910a5ff75e63fc6b23b19ccd79c457b5065a3876f654a3
MD5 hash:
1fc9efed511a8f773868a03b7cc19154
SHA1 hash:
1a7eccbddcaec7d67b358ea586757a8f3a579906
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/33c40eb9-2658-4ecb-99da-079814968449/
Parent samples :
474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54
SH256 hash:
6f68ed57583a3560558cf2b7b1d5ea065c42432850959beecf322f7007e2d09d
MD5 hash:
24aa48de7a48cb76a6ebc02d78686303
SHA1 hash:
1b1f581772abddd9bdb216052088a8e893867f0c
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/33c40eb9-2658-4ecb-99da-079814968449/
SH256 hash:
1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54
MD5 hash:
1b44d7f9a351214acd55379f24658089
SHA1 hash:
4cf4bcdc2860577c204056fd24dc55c025102c25
Link:
https://www.unpac.me/results/33c40eb9-2658-4ecb-99da-079814968449/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1a5526a7c654/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1655282/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195767/

Comments