MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
SHA3-384 hash: ed56760939d321a2cca638c34449e7815383fdedd526b28164b77568b74f4d5da67ec93fbc36855576ae19d07faccfc4
SHA1 hash: dd877b59c9acd80535ad22bdc07525d536a41139
MD5 hash: d6408ae6bf86b97eadfb3f15bbfd7933
humanhash: table-paris-ink-twenty
File name:d6408ae6bf86b97eadfb3f15bbfd7933.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:774'144 bytes
First seen:2020-11-19 09:18:39 UTC
Last seen:2025-01-23 02:37:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0fb7b957c900aa346dfe038d32b1c79f (1 x TrickBot)
ssdeep 12288:Gh6IrzSS5jAVxdzI/YraGvkDbjjiraX2u:66IHS0ePk/oaDSaX
Threatray 616 similar samples on MalwareBazaar
TLSH 54F47D22F791BC44FC5240302B55D6A62458687AE152894BFB4CDF6E7B709C3B8FA70B
Reporter abuse_ch
Tags:exe rob6 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
DNS request
Creating a window
Sending a UDP request
Creating a file in the %temp% directory
Delayed writing of the file
Deleting a recently created file
Launching a process
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/542607
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 04:52:04 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=j3qrxvknf4o4mfdh3y7xdo3lt4a37xjv36h6lbx2kvxsha6jnmqq._file
Verdict:
suspicious
Similar samples:
0837c3f2451e2f7336d5792d605c03de41fddd56d5dfdea5341171bcd2280f70
TrickBot
1cec793bdbe8c3f94fc6e0a02186eff8993f707379e068e9d80d4397f0bb308e
TrickBot
1e1da255c1ecdcaf2cb18202ecac91736e0f199d38fe44faa6cfea88b2c86753
TrickBot
42e45424667f654499511b776d930ffab2947be59d50b555662456363217d32e
TrickBot
4a97c7666ce53a862a84873ad6bcfcd84b5cddd216ac6aa4f15998802d90f94e
TrickBot
616cce9823e315907354d170751633c294e24244a99806416c8e3b1fe0fa3844
TrickBot
8266f6ba4cfed70b35b8eaff7795a27ceb56f29478f146659921d76e8b55bca0
TrickBot
c2aa614bd8ec5de1a299ec25023c89eb60abccc703312f2cdfb31bbcbcbbcc06
TrickBot
d2560651b0b9134e1b8f131381712b03855d01eb65da274d8a553a48da0a0b8f
TrickBot
d659fb6facf4ba90a143e30301658a988585358b35f91ad13c591a3b87fbe2f6
TrickBot
+ 606 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob6 banker trojan
Link:
https://tria.ge/reports/201119-bhw933v3nn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
102.164.206.129:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
Unpacked files
SH256 hash:
4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
MD5 hash:
d6408ae6bf86b97eadfb3f15bbfd7933
SHA1 hash:
dd877b59c9acd80535ad22bdc07525d536a41139
Link:
https://www.unpac.me/results/1e8d36f1-afba-4b95-ac41-2d78d3ccf539/
SH256 hash:
c49eca9f962255b5ef85f573a91609fc53c473665d2e4b58369cf7bfb1844be8
MD5 hash:
58b49a74f39b8a01dbeebb89352cc37d
SHA1 hash:
02139b1431b8fe2534fe0fbc88f6a0212b118cc6
Link:
https://www.unpac.me/results/1e8d36f1-afba-4b95-ac41-2d78d3ccf539/
SH256 hash:
a2d1ea4b40249cb21f750f9dab224c9740af75650c4faff2b03a8fd0b61234b1
MD5 hash:
5ada973beed10cdc01e2d24820becd68
SHA1 hash:
28a6d2585511a5b64168c70c29e435b7ae768d60
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/1e8d36f1-afba-4b95-ac41-2d78d3ccf539/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/831589/
  
Delivery method
Distributed via web download

Comments