MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377
SHA3-384 hash: 2a006e12d70cbfdd81b0356ba204cecef8a5b05bdedecc47c1888f59e564837cd1766082f210c427a8c03f05f64a2fed
SHA1 hash: 7c2a70667792385613980e6e57a6acf72a54d016
MD5 hash: cc251aad6f72e0681fd9b22d6a4d45d1
humanhash: apart-lion-zulu-river
File name:cc251aad6f72e0681fd9b22d6a4d45d1
Download: download sample
Signature TrickBot
Create hunting rule
File size:656'384 bytes
First seen:2021-11-05 21:33:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2a49715e49b2891839bf716e121ca434 (12 x TrickBot)
ssdeep 12288:InZndx1krxFPqBSPiLQuDACflBMhhDKG/M:AZdxuQSPFu8Qm5J
Threatray 4'198 similar samples on MalwareBazaar
TLSH T1F5D4E0103390C032D5A324718A69DBB58E7EB861676275CF3BD91E7E5F24AD1EA3430E
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
269
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/202834/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/6185a3520621d706aeadae72/reports/8f00def5-4e81-480b-9513-dde24015479d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/17527ad6-5133-4996-87eb-50294f55536a
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377/
Threat name:
Win32.Malware.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-11-05 21:35:06 UTC
AV detection:
7 of 44 (15.91%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
567f3596efedff8475d2a21640284f3c12c3053521e9e280ad425f0d5062fc17
TrickBot
6851e85d8f6074bdaf251a40eab78a0603d47d0a7896406d132de7129a1579a8
TrickBot
d418e24f1da80e970160a4192050392dbf3e50a89458f46dbbd753423ebdbbde
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
f723a66d74e36a5e249a72c8f2a4cc4a7a313ecbf83198df5d377bb52f452768
TrickBot
+ 4'188 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot176 banker trojan
Link:
https://tria.ge/reports/211105-1eswasaafq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
9335d48fdc4d8f658194291028c32450f823fdc0521bf6e823bb0e7882c5b0b7
MD5 hash:
0f9de9501b0d3f28fed2cd9734296642
SHA1 hash:
92f3ad27a41774ae916f5cc742ef70f6598e5b6f
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0060e758-b165-490b-a6ad-86f939dcfeeb/
Parent samples :
22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377
06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9
92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d
SH256 hash:
22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377
MD5 hash:
cc251aad6f72e0681fd9b22d6a4d45d1
SHA1 hash:
7c2a70667792385613980e6e57a6acf72a54d016
Link:
https://www.unpac.me/results/0060e758-b165-490b-a6ad-86f939dcfeeb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/22fb786d7903/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/202834/

Comments