MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4b592bd56c7d722bc226dcd4c37630c2483f3771a71e7d4f7e57e9ffb867458e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 8
| SHA256 hash: | 4b592bd56c7d722bc226dcd4c37630c2483f3771a71e7d4f7e57e9ffb867458e |
|---|---|
| SHA3-384 hash: | 0e25c3e8eb2e9257f76d2ba5f7bc1077f31a8957e2bf887498fd5692544a6981b8f76138fa95d34c65ce4ca8db3e9634 |
| SHA1 hash: | 78fe1f1f5547865f1cac31e36da5e970bbf05268 |
| MD5 hash: | cd424ccdabd6cfac66395d687b41db6a |
| humanhash: | one-papa-robert-comet |
| File name: | SecuriteInfo.com.Variant.Mikey.116755.11070.551 |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 417'280 bytes |
| First seen: | 2020-11-16 22:42:53 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | f4f51484e7e7876cfc3cad7263b0656a (1 x TrickBot) |
| ssdeep | 12288:kfApFDevJhm6ussaV+xK/7HINrChkH4rq/:oqOhlnErCaYrq |
| Threatray | 2'950 similar samples on MalwareBazaar |
| TLSH | E794D0577481C033E17E1A384930DA71072FBD23EE60DAAB6754387B6E706C19E35A7A |
| Reporter |  SecuriteInfoCom |
| Tags: | dll TrickBot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Launching a process
Sending a UDP request
Connection attempt
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Zenpak
Status:
Malicious
First seen:
2020-11-15 09:42:00 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 2'940 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:tar3 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
195.123.240.138:443
162.212.158.129:443
144.172.64.26:443
62.108.37.145:443
91.200.103.193:443
194.5.249.195:443
195.123.240.18:443
162.212.158.129:443
144.172.64.26:443
62.108.37.145:443
91.200.103.193:443
194.5.249.195:443
195.123.240.18:443
Unpacked files
SH256 hash:
4b592bd56c7d722bc226dcd4c37630c2483f3771a71e7d4f7e57e9ffb867458e
MD5 hash:
cd424ccdabd6cfac66395d687b41db6a
SHA1 hash:
78fe1f1f5547865f1cac31e36da5e970bbf05268
SH256 hash:
8d6a831e48162f7f7198d19689e216976b8d3deb31a88962fc6e9eaf99718a13
MD5 hash:
8ebabc7eb1c301952dcb484ae47f667e
SHA1 hash:
639d9df718cedaeef34bbf902d776ca62fb0a89f
Detections:
win_trickbot_a4
SH256 hash:
7794cafe1d9b2ad7dde776465d116ae524d499f55d65a87c247789c1678d17a7
MD5 hash:
899ffe43a681cfc068b16d43f77228fe
SHA1 hash:
e10d41714c1525537ec791956e6c0774d0aa6a9e
Detections:
win_trickbot_a4
win_trickbot_auto
SH256 hash:
421585e97eb7dbfcc609cc33d5b90c1cf61a12594ba014f1a048a0abf3197b16
MD5 hash:
07cc11b1cbbaa5119431c735b721495e
SHA1 hash:
f1fbda64c08e54885e141ef4ac22f69226cb7b73
Detections:
win_trickbot_a4
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.