MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45d47fe68294451c9b991eb3941bec03f6c84db9a4b5a962a7b681bac4d9a954. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	45d47fe68294451c9b991eb3941bec03f6c84db9a4b5a962a7b681bac4d9a954
SHA3-384 hash:	4503b116124cfe5af0b9c39639070d0bb412f5f740527ee0ad4580195c20ad4c5ce877651acd096f020ccbd328e4da89
SHA1 hash:	7f60074cb6d918136aee8ac6121eb433f0c517e5
MD5 hash:	dfaeca5d2058d28170075cebb6bf756b
humanhash:	five-south-bacon-skylark
File name:	update2.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	573'440 bytes
First seen:	2020-07-01 17:39:04 UTC
Last seen:	2020-07-01 19:13:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	bceb12141251e0960b8cd04c714c3199 (1 x TrickBot)
ssdeep	6144:I8mgnYQUg3m3Sw94XfiSkzhnAfH0lkTsBuaVYzDCwWYBL:AgYQT23d94XfiSkzhAfHQQsBNVwCwWY
Threatray	2'888 similar samples on MalwareBazaar
TLSH	17C4D01136C1C0B7C4A611F74507C79EC7B6F4618B3A8AC3B7D9168EAE386E1AB32355
Reporter	abuse_ch
Tags:	exe TrickBot

abuse_ch

Malspam distributing TrickBot:

HELO: smtp91.ord1d.emailsrvr.com
Sending IP: 184.106.54.91
From: bspyker@bortnerbros.com
Subject: Files you ask
Attachment: W-2_2020090689.xls

TrickBot payload URL:
http://92.38.171.82/api.php

Intelligence

File Origin

# of uploads :

# of downloads :

145

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

PUA.Win.Downloader.Firseria-6804617-0

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/45d47fe68294451c9b991eb3941bec03f6c84db9a4b5a962a7b681bac4d9a954/

Threat name:

Win32.Trojan.Mansabo

Status:

Malicious

First seen:

2020-07-01 17:41:03 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ixkh7zucsrcrzg4zd2zzig7map3mqtnzus22syvhw2a3vrgzvfka._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

1428aeb0bca8d34f82f582304a44a2a2fba9772f9d66d26b7b8846f3c338db45

TrickBot

1e3177d880626d5aa493a3fbcad02c5d13bc761b367d49eed44dc877d7770d28

TrickBot

2773bfa3367c1ae0a96c8a4022033a838d45d394d95d75486fe9c72fdde18be1

TrickBot

59aa6ae6b1811cf76103fad55377d3755c52d7cf2c48df865dde5de40649904e

TrickBot

a3f763c730e23fab3523b4a501f4590abcc4fd20306cba116c3b726a0d198367

TrickBot

a4bc3940af545287d13414a00eff2f902f8ca487fe2f9ecdbe14e583a15d6d08

TrickBot

c2bd435d054089f7bba982a7edeb9351a5ff68292443e427982904f14dfc7320

TrickBot

c57f7a51f3e98a09dcbc9e292f74933e8bc3795a12ccfb13ee6373421d05d8a1

TrickBot

e12fb5595c938cadc6ab996526dac7046cb9374b4fb842349bad38b567ed165b

TrickBot

+ 2'878 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

trojan banker family:trickbot

Link:

https://tria.ge/reports/200701-a4r86x4xna/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Trickbot

Malware Config

C2 Extraction:

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Please note that we are no longer able to provide a coverage score for Virus Total.