MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 537bb013b6a0355a7cd93dfb789969aeb6a74659f92212c5678c199c39715e97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 537bb013b6a0355a7cd93dfb789969aeb6a74659f92212c5678c199c39715e97
SHA3-384 hash: ed84bd78dfd1efc3fee09f1a0d408b285eaf94ff36abe946e64787b20bea0ced825f42185e32aa6e1737d08ff92b148c
SHA1 hash: 6a5b91ae5c4d2c06dfde0ab03d1bc6666ff47552
MD5 hash: 78eb2d295b1645c61d4130459bdb8d85
humanhash: west-finch-alanine-violet
File name:gigelman.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:421'888 bytes
First seen:2020-07-23 20:04:21 UTC
Last seen:2020-08-02 07:33:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a9125e523681a41a6d16903c78e1e3 (1 x TrickBot)
ssdeep 6144:0i6CDOvhMM8g/NrcDSXoOmVc1C+Awm+zGx+i0W9:0vCkv8g/NruS4xVcfGx+iz
Threatray 4'929 similar samples on MalwareBazaar
TLSH B194CE1F768189F6DC120A71C882AA47723AFC640F6245A7777B372EEFB12C14D72246
Reporter James_inthe_box
Tags:exe man11 TrickBot

Intelligence

File Origin
# of uploads :
4
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/31943/
Detection(s):
PUA.Win.Packer.Armadillo-65
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Delayed writing of the file
Deleting a recently created file
Launching a process
Sending a custom TCP request
Connection attempt
Unauthorized injection to a system process
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/537bb013b6a0355a7cd93dfb789969aeb6a74659f92212c5678c199c39715e97/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 20:04:07 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kn53ae5wua2vu7gzhx5xrgljv23korsz7erbfrlhrqmzyolrl2lq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1630550c5078c495cb0d0e3f0b44ba704752cc290780c19e3551449d73700709
TrickBot
2e1cb31b3b67febb41aa21710caafea0fab22f1031cef01b988efd4ab2052e49
TrickBot
47a67e3cae859886e02539ebc68ccbf81ceca804fdbab710157882d6f94da1a2
TrickBot
67e88a34b883c76e3002f09b021177554a51808c1d6a9e9ece620562d14b0d2f
TrickBot
6b1ab8912b049fb317ae11442e69d43bfe7bec329578397aca357141ecca7c7f
TrickBot
8ad213ec25748fd1689fd993172b430d4ad32d762ca79db48fa818b193866e4d
TrickBot
8dede50daa346a1eaf097717e3cdd6e7ce8c8f29b02553f8958e4a1e1a907268
TrickBot
a0b79027a9be52eb4ce47d8c9bc4f75ea4525483c3c4a437f286e24f2762687c
TrickBot
aa40f4a87f6886c4e5f2cb6962d1effd83bf282b92355115f18ece5a490d0f35
TrickBot
d898d53e4b113d448f3dfe9021e452b739fcd60f6d168c7d757592cb7a1a041a
TrickBot
+ 4'919 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200723-bxhtaxtga2/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Malware Config
C2 Extraction:
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/537bb013b6a0355a7cd93dfb789969aeb6a74659f92212c5678c199c39715e97

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/31943/
  
URLhaus
https://urlhaus.abuse.ch/url/418618/

Comments