MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12
SHA3-384 hash: c827cb086d1238d8d48a34d84f558fd964210d1e2334b3cbc2af04a9ce6ddbba4249c87befeb82ad2ed7390069846842
SHA1 hash: 70c670c92758acb0b2434eb39f92aa299d69ba9d
MD5 hash: 5081001980f7010cfc96b13d7c3392b3
humanhash: salami-missouri-hawaii-pasta
File name:5081001980f7010cfc96b13d7c3392b3.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:442'368 bytes
First seen:2021-10-04 05:28:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 220580f49c2724e661575b7bf3bd58ea (13 x TrickBot)
ssdeep 6144:wkdJN4c+ePGc6r1tJ3VQl/XE3dAPr3x7835OPeFPQimA6Vk58qVEb9pE:wkdJLbPEtlCl/XIIx/lbVMlG
Threatray 3'916 similar samples on MalwareBazaar
TLSH T1D594E02236F0D877D16715309FE59BBCBABAF9104F724A4F33880B0E1D31A525A26776
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
231
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5081001980f7010cfc96b13d7c3392b3.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-04 05:31:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d90491ec-4e55-4409-a556-989e62e2ac96

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194420/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.19991.28780.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/615c2fa4b95458900cdc6416/reports/7a18077e-aa17-4499-938c-8bc024e0c847/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4a84d989-19f7-4613-90b5-c55bb7af5c47
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/863644
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-03 18:39:29 UTC
AV detection:
19 of 45 (42.22%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0e93ebf0a4b74d36142ffb7069359431a77ae3768cb427bff40a107ec1cf9166
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
491c684460b41e06321c3589818a48e376b4a2c9028ae88e0c16050919e13ecb
TrickBot
620255bf64d796af1335256a9d9314e393631ca793c1ace9f3a9b04552c42d7f
TrickBot
6cdc2e665bbfecd57123f410b3f244dd1c390322e96d34ee730c8210261c6eab
TrickBot
7c483138404aad6662938e6e4c100ad9b18ec636011b2dcd96607016d918c938
TrickBot
7f24588c2d42a6f125ccc6b41da4c6f0000f018553086731f2b823b2fe95cab6
TrickBot
969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6
TrickBot
af3346ae78376e9b1a0025c938af5b4dd75842181e30b4ea6a4801f75fe07140
TrickBot
d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15
TrickBot
+ 3'906 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:top128 banker suricata trojan
Link:
https://tria.ge/reports/211004-f6knsagabk/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
4a0cacdad1cbb5a40a7a237d56ab8c1835eb8fe0ae34beea57f4abfd9072549f
MD5 hash:
5fd127f34ac0ef7c7aa3de8f8bbb02d8
SHA1 hash:
119f0da6a48973f939b623b293fa7859b53e28eb
Link:
https://www.unpac.me/results/e9d2c664-0796-4429-b391-d6a171b15f8f/
SH256 hash:
35b58c41d8a038dfad5c61c941922cf33ab9c8449224537c2c8a60f92561f46a
MD5 hash:
a11b3b35e8a3812fed82d9da5b7b4b84
SHA1 hash:
03585543122b207a66e356a76bf33aef2a2362c6
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e9d2c664-0796-4429-b391-d6a171b15f8f/
Parent samples :
491c684460b41e06321c3589818a48e376b4a2c9028ae88e0c16050919e13ecb
7f24588c2d42a6f125ccc6b41da4c6f0000f018553086731f2b823b2fe95cab6
352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12
55a8de65567c29673ebb442c23dadc61356e13dade8c5a2430759ab91d847366
a46307e0930d4ef8071bcb0a0e2837abfb5ca74f6c767eb06854cfa3f6ee066e
SH256 hash:
48e93370a1fc4407f8b7cf55928fbcfeb5d39cfb8ffbd8177fb618a889770704
MD5 hash:
ca63cc01eadf27f3c68c2d936515089b
SHA1 hash:
39c9398e899b2e09d59c00e58c50100f25e5d32f
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e9d2c664-0796-4429-b391-d6a171b15f8f/
SH256 hash:
352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12
MD5 hash:
5081001980f7010cfc96b13d7c3392b3
SHA1 hash:
70c670c92758acb0b2434eb39f92aa299d69ba9d
Link:
https://www.unpac.me/results/e9d2c664-0796-4429-b391-d6a171b15f8f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/352d86804166/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 352d86804166a32518de61db00a237676320341959d212ac02ec574f56f0ef12

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1650383/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194420/

Comments