MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a6bef8525a2b7eded1ea8c92e65cea20a08dc2fff175e37886c7f46846bcb68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 16

Intelligence 16 IOCs YARA File information Comments

SHA256 hash:	1a6bef8525a2b7eded1ea8c92e65cea20a08dc2fff175e37886c7f46846bcb68
SHA3-384 hash:	5e52701ea01aec1f13be846809d29634449a2cd6b83f9aedcb683030690764eecb7ba10e7dabe37cdb50e8d49f3211ab
SHA1 hash:	421b355c7b3311961359bea6e886a316e410bbf8
MD5 hash:	da42b3f16999890ffa59a2aa10a334e5
humanhash:	single-quebec-kentucky-monkey
File name:	da42b3f16999890ffa59a2aa10a334e5.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	422'400 bytes
First seen:	2021-12-30 07:39:42 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	297ed3de0a49d4831344ce5a84729097 (5 x TrickBot)
ssdeep	12288:5F61k9CuRQuCBifx5ABMQ2f6OArPtMZotp:fCuGlQxDni9rV
TLSH	T1A594F11172D4C031E19721348A76CBB10FBABC7675A2AACF2FD5467A4F34AA1D32471E
File icon (PE):
dhash icon	e4d0d0f8e4e8d804 (7 x TrickBot)
Reporter	abuse_ch
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

1'172

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

da42b3f16999890ffa59a2aa10a334e5.exe

Verdict:

Malicious activity

Analysis date:

2021-12-30 07:44:35 UTC

Tags:

evasion

Link:

https://app.any.run/tasks/7f95c4b6-8b99-433d-9afd-792d4583eaab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

TrickBot

Link:

https://www.capesandbox.com/analysis/216849/

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Launching a process

Forced shutdown of a system process

Unauthorized injection to a system process

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/3510/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CheckCmdLine

EvasionGetTickCount

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61cd6259ec6c6c14a9fd699d/reports/ede686dc-768a-46c7-8419-621e45a9d616/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

TrickBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a5c3aef5-7faf-4355-baee-be2a0c7de1e3

Result

Threat name:

TrickBot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/914004

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/1a6bef8525a2b7eded1ea8c92e65cea20a08dc2fff175e37886c7f46846bcb68/

Threat name:

Win32.Trojan.TrickBotCrypt

Status:

Malicious

First seen:

2021-12-30 07:40:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 28 (89.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=djv67bjfuk3633i6vdes4zoouifarxbp74lv4n4inr7unbdlznua._file

Verdict:

malicious

Label(s):

trickbot

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:lip166 banker suricata trojan

Link:

https://tria.ge/reports/211230-jhkknaebhq/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Trickbot

suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2

Malware Config

C2 Extraction:

181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443