MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a8a483deb6c7fb2704e2013aa3672da932b5f0f0b5a70f4c5316798f6e83361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a8a483deb6c7fb2704e2013aa3672da932b5f0f0b5a70f4c5316798f6e83361
SHA3-384 hash: 5b8ae35bb7c4acadd116ede5e4eb7a016a187fb46d2b31629babb87b874d81080e69efe4c01f575bf6255c7996bd220b
SHA1 hash: aaaf980773511d8d003055041000c167ca106118
MD5 hash: 707122c24e3b923727c9c77a0279b743
humanhash: zulu-echo-eleven-five
File name:919cddst.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:338'472 bytes
First seen:2020-08-06 09:30:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4a8c5544cd24df05aabef0164d767361 (413 x TrickBot)
ssdeep 6144:C12iazhHebQnUuPYhVY0YNrkcPdN09Qj8uytOItBwfwzvsmI3WEaCoqNSoIDcTfe:C12tuQPPwYycd0iKDwCv01oqNS1DcTfe
Threatray 4'917 similar samples on MalwareBazaar
TLSH 1374F102E5C74C3AD2652435073D39719AB8DF1417BD9B2376C8C96B2899888DF3EB0B
Reporter JAMESWT_WT
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/40716/
Detection(s):
SecuriteInfo.com.Variant.Zusy.310686.15496.3744.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sending a UDP request
Delayed writing of the file
Deleting a recently created file
Launching a process
Unauthorized injection to a system process
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/413183
Signature
Allocates memory in foreign processes
Delayed program exit found
Found malware configuration
Machine Learning detection for sample
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a8a483deb6c7fb2704e2013aa3672da932b5f0f0b5a70f4c5316798f6e83361/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 06:33:00 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jkfeqpplnr73e4coeaj2unts3kjswxypbnnhb5gfgftzr5xignqq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
24c31a361464ac2cff8595d1fedf298075462cafc6a8e8ba683c865dc5d1db3e
TrickBot
2d71d3708466e8375572db46f3b63d2f41f35246dc08c2944eaf40bd1655a113
TrickBot
3889ebc4fcb4a9d5678ade42c7ca013ad726de53d090069a18e789d5694f2aaa
TrickBot
4aae94a8fa4fda9e6ae9c485b432e2bff7a1020bfc24982e16e4f0ec7608413a
TrickBot
6c74b59e4d9563472c05c4180a7e22160099b3742a5780465f28dc9dcd549585
TrickBot
a62b3eee50f4a13c51ead571ac9707f74f38b5ba2b68eaead7f08f933bc97a2a
TrickBot
b873a60347a8c2c3f74fb212458cef0e078fe91878ac81467819bde3852a200a
TrickBot
c8b7e2c14192425864b7ddf8481fae5719b9f257abdfecc8d2f55f4a809d31d1
TrickBot
dfcd9ba733b1681f19e5ad979e2216004bb7f73d930a91b1133546e6f5d9ac55
TrickBot
ffbe2a17ced982155f3440c04cf483be1ccbc35c4685c9a9af14c6e8af5a2dc1
TrickBot
+ 4'907 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
dave trojan banker family:trickbot
Link:
https://tria.ge/reports/200806-77k22vfvbx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Dave packer
Trickbot
Malware Config
C2 Extraction:
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a8a483deb6c7fb2704e2013aa3672da932b5f0f0b5a70f4c5316798f6e83361

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ReflectiveLoader
Create hunting rule
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 4a8a483deb6c7fb2704e2013aa3672da932b5f0f0b5a70f4c5316798f6e83361

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/424980/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/40716/

Comments