MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 10
| SHA256 hash: | 49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6 |
|---|---|
| SHA3-384 hash: | 5014ec586455abd3cfeca7a6ff7b6979f6313b2613b9f0dbd5cbb037aeaf97dc9c4819335742b6ca6717a9d7784e4456 |
| SHA1 hash: | 9d927792ce07d75f232daf970e9c5b376e6ba572 |
| MD5 hash: | 01be67e885259d6a5a38778a2480ae92 |
| humanhash: | aspen-india-oven-pasta |
| File name: | 01be67e885259d6a5a38778a2480ae92.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 647'168 bytes |
| First seen: | 2021-10-07 08:47:57 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 96459f3ac5474c1f5d7b0f19d0d0d7ca (4 x TrickBot) |
| ssdeep | 12288:f+t405GC8+pDumVo7RBBun3vDNopBzZ3a:eB5GC8+pDSbBMvB4BFa |
| Threatray | 4'003 similar samples on MalwareBazaar |
| TLSH | T1F5D4C012BBD08876C99322324AE3A735A7FDEC015B22C7CB57D46E1EAC726C54D36316 |
| File icon (PE): |  |
| dhash icon | 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT) |
| Reporter |  abuse_ch |
| Tags: | exe TrickBot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
01be67e885259d6a5a38778a2480ae92.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-07 08:49:56 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Result
Threat name:
TrickBot
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.TrickBot
Status:
Malicious
First seen:
2021-10-07 08:48:05 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
5/5
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 3'993 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:lib159 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
23552087f88bd9eaf2910a5ff75e63fc6b23b19ccd79c457b5065a3876f654a3
MD5 hash:
1fc9efed511a8f773868a03b7cc19154
SHA1 hash:
1a7eccbddcaec7d67b358ea586757a8f3a579906
Detections:
win_trickbot_auto
Parent samples :
474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54
SH256 hash:
f309de23aace3fd21e9fd5f8bdcfdc748a579d3650434fa2690c0ddabd30ca83
MD5 hash:
bed037f289498ca10e96c442a97ed098
SHA1 hash:
00e15644a2c08a05318542b5f66017b976cb5d0b
SH256 hash:
65a40344c20dab849f49c9eb24f0a2548af5efbf61b413f716905114aecb4a1f
MD5 hash:
ed16e67abe0490a4a3bbe747ec6bffd1
SHA1 hash:
608a7eef536c650003c9fd0e4b266d80826a583d
Detections:
win_trickbot_auto
SH256 hash:
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
MD5 hash:
01be67e885259d6a5a38778a2480ae92
SHA1 hash:
9d927792ce07d75f232daf970e9c5b376e6ba572
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.