MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20
SHA3-384 hash: cb54086b10394b3fc053037f62cd204ab2bb1f3650bca7422fdb3a1afdae56e4c202a9e85bbfd948ce6dedb040349a1c
SHA1 hash: fe72dc0d7548bdd6b3d5703d4cfc7e5da57265f1
MD5 hash: 60e9dca76408015d98cea97a38c4c81c
humanhash: tennis-east-carbon-rugby
File name:60e9dca76408015d98cea97a38c4c81c.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:851'968 bytes
First seen:2021-10-31 07:08:10 UTC
Last seen:2021-10-31 08:53:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d70d92f424e874b7f2d958376b177fa6 (6 x TrickBot)
ssdeep 12288:m1d+w0o2/pnRsHnF2XqBNiKtxRDB02HTUj/AUYQ+wsE6tn6tLB:Mesl2XqBNicTtZQO1wB
Threatray 1'153 similar samples on MalwareBazaar
TLSH T18105CF123AB0C077E2B291754EF67B69A2FDA9205F674DC723810B5D7E31CC1573A22A
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
369
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
60e9dca76408015d98cea97a38c4c81c.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-31 07:20:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1b7b03c2-4d30-4cc6-b373-e8540a7492e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.79442.29241.5062.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4e26aab3-1655-4202-ae9a-dd0c4dee2294
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879933
Signature
Allocates memory in foreign processes
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1872 Sample: nFHZS2HLKK.exe Startdate: 31/10/2021 Architecture: WINDOWS Score: 100 30 wtfismyip.com 2->30 32 16.52.17.84.zen.spamhaus.org 2->32 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Multi AV Scanner detection for domain / URL 2->42 44 Found malware configuration 2->44 46 4 other signatures 2->46 8 nFHZS2HLKK.exe 2->8         started        11 cmd.exe 1 2->11         started        signatures3 process4 signatures5 48 Writes to foreign memory regions 8->48 50 Allocates memory in foreign processes 8->50 13 wermgr.exe 4 8->13         started        18 cmd.exe 8->18         started        20 nFHZS2HLKK.exe 11->20         started        22 conhost.exe 11->22         started        process6 dnsIp7 34 128.201.76.252, 443, 49793, 49795 PedroFArrudaJuniorMEBR Brazil 13->34 36 221.147.172.5, 443, 49864 KIXS-AS-KRKoreaTelecomKR Korea Republic of 13->36 38 wtfismyip.com 95.217.228.176, 49794, 80 HETZNER-ASDE Germany 13->38 28 C:\Users\user\AppData\...\nFHZS2HLKK.exe, PE32 13->28 dropped 52 Tries to harvest and steal browser information (history, passwords, etc) 13->52 54 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 13->54 56 Multi AV Scanner detection for dropped file 20->56 58 Writes to foreign memory regions 20->58 60 Allocates memory in foreign processes 20->60 24 wermgr.exe 20->24         started        26 cmd.exe 20->26         started        file8 signatures9 process10
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-31 02:58:18 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iyj3wc7ootoh6w7tgrhwuli7wnjxc7gc2adgkmgp77utuyetruqa._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1455e78e95b8e3b9df5eb8d8d1703018c927694c6269e01f1b846abdfa054b82
TrickBot
6db7642e42467842b97947426d78418e58c1e0b25f125ce0faa8bfa6436a70b2
TrickBot
784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e
TrickBot
968a796e04e6cf1ee9bcfb89923369373056790e9d37afaaeeacbb427f5a891f
TrickBot
9890dddc8087d395c5eab7410880b35d3e790d11ab08f2b4a039818e814f21ed
TrickBot
e1b7ffcc831b6b0ef56e665e5f0f8daee789b9426e8dce21e44fbbe9518acbdb
TrickBot
f8cdd0190b5b1bc3a441e8298cdedec9f09bca6ff99ec0b461d7730985ffb78b
TrickBot
+ 1'143 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lip143 banker trojan
Link:
https://tria.ge/reports/211031-hys2asffe4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
1011e2de669ab71b736112c16c98cba88c39f628434f12de4d143dede9cedd1f
MD5 hash:
2e69aa5ea97b9c9858242142d7a59b31
SHA1 hash:
cdbe21595f883622414045c83eb972caeb7e5eaa
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/2102c04d-e0dc-4f18-a030-c151ecbba758/
Parent samples :
89b3499862e34095b284fc1b97bdd3f2d2f7bf56b6f43bfaed554d9872498bc7
4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20
549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e
64c5309cb3d2245b3dfadf321296c8a7cf86c9ae33764e09a41932c3c4fc823e
94d90e7f0577f2e80461a2eef2bfe4710a6e1afddb6bb2b0585610c1dda0beec
SH256 hash:
91b7380505157f40c574254f7371c6ddf6cf01fdb4914b7381904b94bf404373
MD5 hash:
678c6702aee668dbcde3082290031100
SHA1 hash:
bf315d182181c37a07ba3de3d9fcf0fb23eaa2ac
Link:
https://www.unpac.me/results/2102c04d-e0dc-4f18-a030-c151ecbba758/
SH256 hash:
2504b296cacf0e0776bc50f8d05ba3121be06fae87bb4713372aebf81339425c
MD5 hash:
4e8fdb995f3c7ca9938806061b07449b
SHA1 hash:
aa3398bc63b1e5bafdb9e1423ddff9253b41627c
Link:
https://www.unpac.me/results/2102c04d-e0dc-4f18-a030-c151ecbba758/
SH256 hash:
4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20
MD5 hash:
60e9dca76408015d98cea97a38c4c81c
SHA1 hash:
fe72dc0d7548bdd6b3d5703d4cfc7e5da57265f1
Link:
https://www.unpac.me/results/2102c04d-e0dc-4f18-a030-c151ecbba758/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.trickbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1698135/
  
Delivery method
Distributed via web download

Comments