🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c
SHA3-384 hash: 32fff006998840e3e3829ddb8eb01489fe2c55482be185188691084b22536e467f25ae21d310e532aed3b41abf48c716
SHA1 hash: 1a66dc68510e10ce83ce0c938c185bf67cf0eb44
MD5 hash: ba820cf3ca3957bd6401fc39b8d692b9
humanhash: crazy-happy-maryland-red
File name:ba820cf3_by_Libranalysis
Download: download sample
Signature TrickBot
Create hunting rule
File size:547'608 bytes
First seen:2021-05-04 10:02:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ea97e91275f65096e0769ec8f21f572b (18 x TrickBot)
ssdeep 12288:Zx1Q61iHsXYvfVpMODDawkCurdEtttYW60EQSO1A:ZXQUIsQpMsequrmGh
Threatray 3'213 similar samples on MalwareBazaar
TLSH D7C4E02A37E1CCB7C5A755790EE2DBAA62FAFD204F718A8323543B0D4E31AD15931316
Reporter Libranalysis
Tags:TrickBot


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
332
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Midie-7369865-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Launching a process
Creating a file in the %AppData% subdirectories
Sending a UDP request
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/709748
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
Writes to foreign memory regions
Yara detected PersistenceViaHiddenTask
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 403798 Sample: ba820cf3_by_Libranalysis Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 36 181.49.61.237 TelmexColombiaSACO Colombia 2->36 38 190.13.160.19 TelefonicadelSurSACL Chile 2->38 40 42 other IPs or domains 2->40 56 Multi AV Scanner detection for domain / URL 2->56 58 Found malware configuration 2->58 60 Antivirus / Scanner detection for submitted sample 2->60 62 8 other signatures 2->62 8 ba820cf3_by_Libranalysis.exe 3 2->8         started        11 ????????.exe 15 2->11         started        14 ????????.exe 6 2->14         started        signatures3 process4 file5 28 C:\ProgramData\????????.exe, PE32 8->28 dropped 30 C:\ProgramData\????????.exe:Zone.Identifier, ASCII 8->30 dropped 16 ????????.exe 15 8->16         started        66 Antivirus detection for dropped file 11->66 68 Multi AV Scanner detection for dropped file 11->68 70 Machine Learning detection for dropped file 11->70 19 svchost.exe 1 11->19         started        72 Writes to foreign memory regions 14->72 74 Allocates memory in foreign processes 14->74 22 svchost.exe 14->22         started        signatures6 process7 dnsIp8 48 Antivirus detection for dropped file 16->48 50 Multi AV Scanner detection for dropped file 16->50 52 Machine Learning detection for dropped file 16->52 54 2 other signatures 16->54 24 svchost.exe 3 16->24         started        42 36.89.85.103, 449 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID Indonesia 19->42 44 170.82.156.53, 449 NEDETELSAEC Ecuador 19->44 46 2 other IPs or domains 19->46 signatures9 process10 file11 32 C:\Users\user\AppData\...\????????.exe, PE32 24->32 dropped 34 C:\Users\...\????????.exe:Zone.Identifier, ASCII 24->34 dropped 64 Benign windows process drops PE files 24->64 signatures12
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 08:45:00 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjy7nhbmporjdvmiw7omg4pxfiixyct7hqx6qztw23jkrarokkoa._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
065632e06e556d26314865646f6fdb70585e3ee1a96336f8ae1787da420c0dfb
TrickBot
21eb1f5b9170df8296b225d8418a19416b88bb7f4bb481cec089c4877352047b
TrickBot
470709ae927e258a0203e90cc52d6974b7b6a00dd5f2bde4f96eec50c90a940b
TrickBot
7b43ae26d4c95a64acb84a54f87c38d86c9133606ee6eb31d65e7c1b4a146409
TrickBot
7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983
TrickBot
9754089f79d9c9293dcc9c604c6328284a7942539a46c13112558a39c92a5e41
TrickBot
a19896b2206755083b9881636def83c36555331f4e4976602eb5944ce15917c5
TrickBot
d2122f044167ecb831d202ce7829d2e50a902266f7e290e42b5ff432e8879b9a
TrickBot
f3c8bc00960cf4d8c190ada51ebfd80c4997cee9de8cb8fbd075e61391d9c734
TrickBot
fe6536af67f91c583d23236ccd090fce698b2f875e5906a0d2dd30d2a59072cf
TrickBot
+ 3'203 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:ono23 banker trojan
Link:
https://tria.ge/reports/210504-jz9dj5qgsa/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Trickbot
Trickbot x86 loader
Malware Config
C2 Extraction:
144.91.79.9:443
172.245.97.148:443
85.204.116.139:443
185.62.188.117:443
185.222.202.76:443
144.91.79.12:443
185.68.93.43:443
195.123.238.191:443
146.185.219.29:443
195.133.196.151:443
91.235.129.60:443
23.227.206.170:443
185.222.202.192:443
190.154.203.218:449
178.183.150.169:449
200.116.199.10:449
187.58.56.26:449
177.103.240.149:449
81.190.160.139:449
200.21.51.38:449
181.49.61.237:449
46.174.235.36:449
36.89.85.103:449
170.233.120.53:449
89.228.243.148:449
31.214.138.207:449
186.42.98.254:449
195.93.223.100:449
181.112.52.26:449
190.13.160.19:449
186.71.150.23:449
190.152.4.98:449
170.82.156.53:449
131.161.253.190:449
200.127.121.99:449
45.235.213.126:449
31.128.13.45:449
181.10.207.234:449
201.187.105.123:449
201.210.120.239:449
190.152.125.22:449
103.69.216.86:449
128.201.174.107:449
101.108.92.111:449
190.111.255.219:449
Unpacked files
SH256 hash:
6257775e282744c614a6c12864f5f07f5a8584335161bb7b8d13206f8f7fd92e
MD5 hash:
f8ea2fa5c4adfc2c7ec5b146f6921f36
SHA1 hash:
ab10240428804877069afbd817819050a2e8bb1c
Link:
https://www.unpac.me/results/0afdee79-74e9-457c-8edc-73a5d406d9e6/
SH256 hash:
b3ae88be10281b8af9183d3ec7cd8a9b0b4cbccf1b20c012994f37ff8c0bced6
MD5 hash:
03f8042b349cbd69f5bc4cc1195608d3
SHA1 hash:
970a1bd44f439c5dcf388cfa79c14683f04b1ea9
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g5
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0afdee79-74e9-457c-8edc-73a5d406d9e6/
Parent samples :
c96ac26cb9cc069941deba2210c0c6ef9358d6605005aa318ac2a1774da9d872
7ddc410b3d455415f58ab98ded230a9bd9617c7c894588475e3b003cbf904754
a305fedc0b76bc6a36c92b06664f96a3a85f3784c1b8a272f00bce9f623fc9e8
fe6536af67f91c583d23236ccd090fce698b2f875e5906a0d2dd30d2a59072cf
065632e06e556d26314865646f6fdb70585e3ee1a96336f8ae1787da420c0dfb
a19896b2206755083b9881636def83c36555331f4e4976602eb5944ce15917c5
d6b893f5ddab88602eb6d5b6ac200b709f53ba72dc9310680d7b0262ac67eede
34aba4b668b4f82e6fce7f6fc02c1d1c82a0352692979604d145f38ab2bd3433
7e29d464e336d904d8aee54edf8b499c4095c3659a8b202218903f071239d983
d2122f044167ecb831d202ce7829d2e50a902266f7e290e42b5ff432e8879b9a
9754089f79d9c9293dcc9c604c6328284a7942539a46c13112558a39c92a5e41
e9c98bff81ba5138f040cef7acbcb56f0f80abcf41ecf4893d4700e308f6427a
5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c
9fdea40a9872a77335ae3b733a50f4d1e9f8eff193ae84e36fb7e5802c481f72
SH256 hash:
5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c
MD5 hash:
ba820cf3ca3957bd6401fc39b8d692b9
SHA1 hash:
1a66dc68510e10ce83ce0c938c185bf67cf0eb44
Link:
https://www.unpac.me/results/0afdee79-74e9-457c-8edc-73a5d406d9e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tinba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5271f69c2c7ba291d588b7dcc371f72a117c0a7f3c2fe86676d6d2a8822e529c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:IceID_Bank_trojan
Create hunting rule
Author:unixfreaxjp
Description:Detects IcedID..adjusted several times
Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-04 11:05:35 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
1) [C0049] File System Micro-objective::Get File Attributes
2) [C0051] File System Micro-objective::Read File
3) [C0052] File System Micro-objective::Writes File
4) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
5) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
6) [C0036.002] Operating System Micro-objective::Delete Registry Key::Registry
7) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
8) [C0036.005] Operating System Micro-objective::Query Registry Key::Registry
9) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
10) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
11) [C0040] Process Micro-objective::Allocate Thread Local Storage
12) [C0041] Process Micro-objective::Set Thread Local Storage Value
13) [C0018] Process Micro-objective::Terminate Process