MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102
SHA3-384 hash: 7ef164601c752fb7e33a48a204485a6c47f723ea5f0ca50f556747b9cc896ef14e1239f86b5efd775b4074ac99d4b388
SHA1 hash: 28520050ca43b81c6a7bf26cbe357219f026ee01
MD5 hash: f0b1d40c2f19222e6023cded6349f26c
humanhash: harry-two-angel-echo
File name:f0b1d40c2f19222e6023cded6349f26c.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:438'784 bytes
First seen:2021-09-03 07:18:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f65017d8831ffbffdcc0a43ba69f6901 (1 x TrickBot)
ssdeep 12288:mkRf7Sd2ji/ZE0Ym16ejbeWzrTKjex+wb/m4R:TRfmG0YgKwrTKjext
Threatray 3'852 similar samples on MalwareBazaar
TLSH T11394D03036E0C072D157247486F9C7B15A7EF8602B61A9CFBFD90A7A6F25AD1873530A
dhash icon 1072f0dcccdc54d4 (2 x TrickBot)
Reporter abuse_ch
Tags:exe tot142 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f0b1d40c2f19222e6023cded6349f26c.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-03 07:24:04 UTC
Tags:
installer
Link:
https://app.any.run/tasks/d0b784bc-b351-47fe-82ff-59230e2aed45

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185042/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Sending a UDP request
Launching a process
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d4314da9-168b-4731-836e-03b07edbdc7f
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/844582
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Machine Learning detection for sample
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 477013 Sample: 6ziyKlA9M7.exe Startdate: 03/09/2021 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->53 55 Found malware configuration 2->55 57 Yara detected Trickbot 2->57 59 4 other signatures 2->59 8 6ziyKlA9M7.exe 1 2->8         started        12 cmd.exe 1 2->12         started        process3 dnsIp4 45 15.1.0.0 ATT-IPFRUS United States 8->45 63 Writes to foreign memory regions 8->63 65 Allocates memory in foreign processes 8->65 14 wermgr.exe 8->14         started        18 cmd.exe 8->18         started        20 conhost.exe 12->20         started        signatures5 process6 dnsIp7 47 179.42.137.107, 443 TelefonicadeArgentinaAR unknown 14->47 49 194.190.18.122, 443, 49707, 49722 KTTRADE-ASRU Russian Federation 14->49 51 8 other IPs or domains 14->51 67 Hijacks the control flow in another process 14->67 69 Writes to foreign memory regions 14->69 71 Tries to detect virtualization through RDTSC time measurements 14->71 73 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 14->73 22 svchost.exe 11 14->22         started        27 svchost.exe 14->27         started        29 svchost.exe 14->29         started        31 svchost.exe 14->31         started        signatures8 process9 dnsIp10 43 203.112.154.106, 443, 49728 MINS-ASMINSTechnologiesPrivateLimitedIN India 22->43 35 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 22->35 dropped 37 C:\Users\user\AppData\...\Login Data.bak, SQLite 22->37 dropped 39 C:\Users\user\AppData\Local\...\History.bak, SQLite 22->39 dropped 41 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 22->41 dropped 61 Tries to harvest and steal browser information (history, passwords, etc) 22->61 33 WerFault.exe 3 9 27->33         started        file11 signatures12 process13
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102/
Threat name:
Win32.Backdoor.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-09-03 07:19:05 UTC
AV detection:
22 of 43 (51.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqwg7clm7vsva3hbsqhizgic4r7ssimdbsuaqxi6fbd7y634weba._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0add7ef3e57fd9a619be1befd6df759a53b53952c4c2b4a10facdddedcc5174c
TrickBot
104b914e642490aa18ec1b1eeeea70e288e7c6bbce699f37ac3ac8a2603a8341
TrickBot
149092132cc1f8835218eeabb3e2df8affc26ec400827e237478fd5431aaf079
TrickBot
2cadf2841f6e4103ce2db16e443c63b060bae86812bcc90d3d4e93f09e6f5425
TrickBot
58eb3b6a9dd371f2b5c39166f7f52d0fdaa6ec8a32962221cf4f44a47c3e67e7
TrickBot
892a84154516ef80df5f1764f1629c5254795669277f5ca324a035861d774cb7
TrickBot
bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942
TrickBot
+ 3'842 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot142 banker trojan
Link:
https://tria.ge/reports/210903-h5htxafhap/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
0f14281bcb89163749ee44c8a41e40b45a409f6746f0647536daccba6426e31d
MD5 hash:
cdd9085ab7bfea02f01b231ecb91f3f4
SHA1 hash:
4fa33ebc26c64e571e17c81478ade2d6488d0c5e
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7da0813c-9140-4bd4-b936-ad2cd66f703d/
SH256 hash:
342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102
MD5 hash:
f0b1d40c2f19222e6023cded6349f26c
SHA1 hash:
28520050ca43b81c6a7bf26cbe357219f026ee01
Link:
https://www.unpac.me/results/7da0813c-9140-4bd4-b936-ad2cd66f703d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/342c6f896cfd/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/185042/

Comments