MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb
SHA3-384 hash: 1b52fd2833ba91e8070bab45b600fdccb3fd1072da705d4fc59cef37b91031e310d2734db43598ca33ad789b37ad4236
SHA1 hash: e97bf870f4b513c6309000bcba8955b99e5a0b2e
MD5 hash: 89af65215bc0590db38932e27412702d
humanhash: twenty-river-july-spaghetti
File name:89af65215bc0590db38932e27412702d.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:471'040 bytes
First seen:2021-10-22 10:09:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 80d506598da867a09b35bc1fdb2d74ee (2 x TrickBot)
ssdeep 6144:b96ZhRWIiMiCIF1DXBVmdCeyNAxR/oLgC+j9Jbnndik1IysdF3bQQYseb:b96Z/niySBVmZy2vuMJJr8k1IysdZcQ
TLSH T1D3A4F1223AE1C873C15341314FD7ABB9B3BCE9044F228A5377D89F1D2D359B15A2B2A5
File icon (PE):PE icon
dhash icon 71f8f0e0f2ea78b9 (3 x TrickBot, 1 x BazaLoader)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
367
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/199352/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/61728e009a5a1e91c5ceb443/reports/2a61f114-a018-44c1-a4ad-b30c458193e9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fe541039-638a-4d32-a62e-949dbe120243
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/875141
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-22 10:10:11 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxapbpcvljkbtmgpclttndeabgyj7zoau3phqz5eopcbrr62hx5q._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lip139 banker suricata trojan
Link:
https://tria.ge/reports/211022-l7dvhscchn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
61c93ab540a674c5edbebdb58eec0fe39cbd1186c65e9ce51593082640e90fa8
MD5 hash:
4fcdc18f8346b23d1cd474076ad8bcc6
SHA1 hash:
7c60424516d5806a315350445382effac367e0fe
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0aef7bce-3933-40a3-b550-8a4fb1144b9f/
Parent samples :
59ebd6bc57fb358ceb738d4ebd339910a443b21285f6efb7fb5bd784ff9f3e20
2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb
SH256 hash:
980548eff06c641f1ae24d8785be73d5893ccd0f1b2767b83760999cfc054057
MD5 hash:
2c7749b21c9dc9dbfc8dd9f388388c02
SHA1 hash:
51dbe008480fb9bc725bf390a292099efb28caa5
Link:
https://www.unpac.me/results/0aef7bce-3933-40a3-b550-8a4fb1144b9f/
SH256 hash:
bc63884df030f42991acffd75ace1a22a140dbd2b9c026292e95f7b5a00969fc
MD5 hash:
173d8db7a9f1f147786cbe66dc4287bb
SHA1 hash:
031986a620bb5ba6ea250664450e8d3bd13ad2a8
Link:
https://www.unpac.me/results/0aef7bce-3933-40a3-b550-8a4fb1144b9f/
SH256 hash:
2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb
MD5 hash:
89af65215bc0590db38932e27412702d
SHA1 hash:
e97bf870f4b513c6309000bcba8955b99e5a0b2e
Link:
https://www.unpac.me/results/0aef7bce-3933-40a3-b550-8a4fb1144b9f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/199352/
  
URLhaus
https://urlhaus.abuse.ch/url/1698135/
  
Delivery method
Distributed via web download

Comments