MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a
SHA3-384 hash: af6a184950904923f545b70d9bbd00cb8d085d1307547990c9f8ab28562c811f2925bf78afd7a7a65c0893a7bfb71902
SHA1 hash: 68ea1ea5e7534ad7e3abb68447c26c47eb265367
MD5 hash: 00af0f44a7eeaf8cec9d8ae9a5902ade
humanhash: cup-cardinal-arkansas-gee
File name:00af0f44a7eeaf8cec9d8ae9a5902ade.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:880'640 bytes
First seen:2021-11-03 20:17:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5c272247eecddf77307138917800d024 (6 x TrickBot)
ssdeep 12288:y0qKG+wPRvCKXb4+aliMESpaPyyzY+NSbILBzLqkRYKpD4rSs1l:4P5Xb4+wiMES/XstzLWu4rSs1
Threatray 4'499 similar samples on MalwareBazaar
TLSH T19215CE567DF0C07BD2A691710EF4BB7A62F999205B274ECB27908B1D3E31CC0563627A
File icon (PE):PE icon
dhash icon 78a399ad3c1c2d2c (6 x TrickBot)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
00af0f44a7eeaf8cec9d8ae9a5902ade.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-03 20:28:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/650e5fa1-9a51-4080-b22e-eaa4b5775f95

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/202064/
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/6182ee7e9982ff7c3f7e29a1/reports/4b0ca34c-ccb9-46c4-8be2-8bb456cf8cdf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dd0e2543-8c51-4d45-8e4c-740356ad10c1
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/882617
Signature
Allocates memory in foreign processes
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-03 20:18:08 UTC
AV detection:
22 of 27 (81.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fu6swzfvtquhacfnwnxo5qrmlb3n6o3kjdfg2hxb4o5xumc464fa._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
83f374f57d674ac1abf87f968ba37237e5403bcae01ded47b7a912c4c5a58163
TrickBot
d418e24f1da80e970160a4192050392dbf3e50a89458f46dbbd753423ebdbbde
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
fa18696ec34e6230f7720bbd7957b45d600a7e42e9e5f344ae003ba6ba5dcb2a
TrickBot
fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
TrickBot
+ 4'489 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:top144 banker trojan
Link:
https://tria.ge/reports/211103-y3acraehd6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
2a41159d46a18f82a71976a53eab92f54a206fa49738f1c5f344ebc65c52a1f3
MD5 hash:
ddfa99aca84a417d725beae46cf8a175
SHA1 hash:
d7e054c47d4019855ad2fe12c026c38ef4c5d866
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6850089b-d29a-4ce5-9bea-29673b2c0dcb/
Parent samples :
08e5741c3b16857759cfcf90f25de739117cebfe1fc34d6f841d5a5c1f5e6927
e9f6d1a2c238f02d3bfb8e909e22e085597923220edb929e33997b1ebe76c392
2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a
SH256 hash:
9902a1aa083b32f5867931451e5ae35f1654a917e6eb23d788d8c226786261eb
MD5 hash:
05dcf112733acd96e41eef38930852b8
SHA1 hash:
398aae34800ac706513c433e5c3753e140b8f8b0
Link:
https://www.unpac.me/results/6850089b-d29a-4ce5-9bea-29673b2c0dcb/
SH256 hash:
9b8806a2f4a64f82d1d0cfb9ebf4c63f080abda8b413d61bcdb7dbdcdfc9a99a
MD5 hash:
37478b6aef83fc6e3d0fdfc5806b1dbb
SHA1 hash:
e5bdeb105b2177057a996824ecfa0b84beba7702
Link:
https://www.unpac.me/results/6850089b-d29a-4ce5-9bea-29673b2c0dcb/
SH256 hash:
2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a
MD5 hash:
00af0f44a7eeaf8cec9d8ae9a5902ade
SHA1 hash:
68ea1ea5e7534ad7e3abb68447c26c47eb265367
Link:
https://www.unpac.me/results/6850089b-d29a-4ce5-9bea-29673b2c0dcb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/2d3d2b64b59c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 2d3d2b64b59c287008adb36eeec22c5876df3b6a48ca6d1ee1e3bb7a305cf70a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1698136/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/202064/

Comments