MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
SHA3-384 hash: 2046361bf5a84d042e20644e89d2f828b724c3432b683e88640bf7ba16c01a38c9fb3f2eca07e8fb321c8679f1fe80ad
SHA1 hash: c49355c0da52388919a3865265643eebd34355c5
MD5 hash: ae0d4979f5024ead144046badfa91a4c
humanhash: three-nine-missouri-beer
File name:494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
Download: download sample
Signature TrickBot
Create hunting rule
File size:614'400 bytes
First seen:2020-11-12 14:21:55 UTC
Last seen:2024-07-24 13:51:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 8d30e57c6a35a6f8994c5967f3d6d712 (4 x TrickBot)
ssdeep 12288:aJBfWwcRr/SjcaUEfpWygb2xglS/ORfEGT9cpPFTj:UOyzxglSVy2pPFTj
TLSH 77D46C135DAD65E0E15205305E3A5F65283BBC263850EA4BD7A0BD6CE873783E8B532F
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Connection attempt
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:25:35 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jfaybrvrokb5dked433jayphw25iwbkpbcvfsdsahz6esdre56oq._file
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib7 banker trojan
Link:
https://tria.ge/reports/201112-23seevhgrj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Trickbot
Malware Config
C2 Extraction:
202.136.89.226:449
202.169.244.252:449
203.176.135.38:449
212.3.104.50:449
41.203.215.122:449
41.41.179.239:449
43.239.152.240:449
43.242.141.59:449
43.245.216.190:449
43.255.113.180:449
45.230.8.34:449
45.233.25.6:449
78.138.128.20:449
49.156.41.74:449
Unpacked files
SH256 hash:
494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
MD5 hash:
ae0d4979f5024ead144046badfa91a4c
SHA1 hash:
c49355c0da52388919a3865265643eebd34355c5
Link:
https://www.unpac.me/results/8e3df83a-b5da-4bb9-b776-416bab4511f1/
SH256 hash:
f1f504e14a06fd1ab3412bb1db7c46d431dc06a492f9f3cb782963c4b9c8f764
MD5 hash:
d45dced0af27f1a6333c55c021a58207
SHA1 hash:
69f359495ce66fe214171882275a681dd0b15029
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8e3df83a-b5da-4bb9-b776-416bab4511f1/
SH256 hash:
e4ffade6a267935b4f699cbe9de7b4d716edb735f3fd52434dc7c62c0aa570ff
MD5 hash:
949ffd4f39b63905165149fdfbc2a855
SHA1 hash:
1269c4afeaa03297558e3e793a624885eff46daa
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8e3df83a-b5da-4bb9-b776-416bab4511f1/
Parent samples :
7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments