MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f
SHA3-384 hash: 9ceff85af530c6c1894ba865b26d23e1f7a68080b069cc156a6bdd6a3f0cae6ed37b7ee9791e51168f17547d45e7fd30
SHA1 hash: 810dbe6d8b4413879272d00705be02d02269f4fb
MD5 hash: 3ee559cdf66554515d87e5edbc23c8cf
humanhash: georgia-cat-salami-wolfram
File name:3ee559cdf66554515d87e5edbc23c8cf.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:450'560 bytes
First seen:2021-10-11 08:20:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f8cb6cf7a746c79f8c917be532cea46e (8 x TrickBot)
ssdeep 6144:oxcZrtODZGn9XI1cKYkh2JmvYvWFuQX7tPbzHhzWEI8BmNbeIM625anGD:emIDZMkRYvWMQX5z0J8INqzkGD
Threatray 3'995 similar samples on MalwareBazaar
TLSH T17EA4D023F1F0C8F6C1A316710DB15BAE7676FC10CBB5DA9753805A6D1C3269689233A7
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3ee559cdf66554515d87e5edbc23c8cf.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-11 09:11:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/05dc3a93-66c2-46e8-876d-091fe30bd30e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/196533/
Detection(s):
Win.Dropper.Zusy-9901116-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/6163f3f01c2d58ba74016cbe/reports/4740b6f6-c58f-4b08-a53c-9bca6193403e/overview
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/868087
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 07:40:01 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
295a8418d504dd81e1066eab3e78924fb107e3f74301f56be89544e942c19b9b
TrickBot
491c684460b41e06321c3589818a48e376b4a2c9028ae88e0c16050919e13ecb
TrickBot
620255bf64d796af1335256a9d9314e393631ca793c1ace9f3a9b04552c42d7f
TrickBot
6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af
TrickBot
7329669d8afc510a838f43ca91821e5b01c157fb397f1f347490b4e028bbf6eb
TrickBot
8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
TrickBot
969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6
TrickBot
d4fa44048095c1177007ec54df4b73e6a70e8b092718605eef93a573c79a54af
TrickBot
+ 3'985 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib161 banker trojan
Link:
https://tria.ge/reports/211011-j81dssgfc3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
69d7ed37a28c55a127c7c30e60de8c30136037c96882bc31f6738868af2128d8
MD5 hash:
86e674d08ed461c335609f49aa5c532b
SHA1 hash:
f3344e3224e9da719356a6823dd1a067625b8c77
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/50f9c9af-c23e-4e7c-9d3f-fd2de78c9078/
Parent samples :
8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f
SH256 hash:
72bbcafef8824b6d324736c62ce15951ac546291b180017b3ebc82bcf3f1bac2
MD5 hash:
4ecc3982d91503b95135dabff700db39
SHA1 hash:
74812c6c53fce012244cd0e4a83417d5443d62f1
Link:
https://www.unpac.me/results/50f9c9af-c23e-4e7c-9d3f-fd2de78c9078/
SH256 hash:
ad11bc4e7b11995843790f4e44d7693fd27c418365a7105dbd54306c45db5c1f
MD5 hash:
3c132a9d469fdafbc082aa1aeb625db5
SHA1 hash:
c75e6c696989bbd6d08cb425c5449037319ffd61
Link:
https://www.unpac.me/results/50f9c9af-c23e-4e7c-9d3f-fd2de78c9078/
SH256 hash:
1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f
MD5 hash:
3ee559cdf66554515d87e5edbc23c8cf
SHA1 hash:
810dbe6d8b4413879272d00705be02d02269f4fb
Link:
https://www.unpac.me/results/50f9c9af-c23e-4e7c-9d3f-fd2de78c9078/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1b4868da8f52/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1655282/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196533/

Comments