MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 11
| SHA256 hash: | 549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e |
|---|---|
| SHA3-384 hash: | 33074b59d4adb27d5e9bdde19a5568a4d8e946c58978e555040871897cad5bc6fd16ce338d523fb47fa8fd5e2aa290bb |
| SHA1 hash: | 51f05219c127a40e6054bdad597a4c8adf306f08 |
| MD5 hash: | 818ddb3d73670d6ed670bd689d481cca |
| humanhash: | coffee-nine-summer-tango |
| File name: | 818ddb3d73670d6ed670bd689d481cca.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 851'968 bytes |
| First seen: | 2021-10-31 07:23:50 UTC |
| Last seen: | 2021-10-31 08:53:48 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d70d92f424e874b7f2d958376b177fa6 (6 x TrickBot) |
| ssdeep | 12288:m1d+w0o2/pnRsHnF2XqBNiKtxRDB02HTUj/AUYQ+wsE6tn6tsB:Mesl2XqBNicTtZQO1XB |
| Threatray | 4'210 similar samples on MalwareBazaar |
| TLSH | T1F405CF123AB0C077E2B291754EF67B69A2FDA9205F674DC723810B5D7D31CC1573A22A |
| File icon (PE): |  |
| dhash icon | 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT) |
| Reporter |  abuse_ch |
| Tags: | exe TrickBot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
402
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
818ddb3d73670d6ed670bd689d481cca.exe
Verdict:
Malicious activity
Analysis date:
2021-10-31 07:40:10 UTC
Tags:
evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Verdict:
Malicious
Result
Threat name:
TrickBot
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
Allocates memory in foreign processes
Found detection on Joe Sandbox Cloud Basic with higher score
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.TrickBot
Status:
Malicious
First seen:
2021-10-30 14:24:17 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
5/5
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 4'200 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:lip143 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
1011e2de669ab71b736112c16c98cba88c39f628434f12de4d143dede9cedd1f
MD5 hash:
2e69aa5ea97b9c9858242142d7a59b31
SHA1 hash:
cdbe21595f883622414045c83eb972caeb7e5eaa
Detections:
win_trickbot_auto
Parent samples :
89b3499862e34095b284fc1b97bdd3f2d2f7bf56b6f43bfaed554d9872498bc7
4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20
549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e
64c5309cb3d2245b3dfadf321296c8a7cf86c9ae33764e09a41932c3c4fc823e
94d90e7f0577f2e80461a2eef2bfe4710a6e1afddb6bb2b0585610c1dda0beec
4613bb0bee74dc7f5bf3344f6a2d1fb353717cc2d0066530cfffe93a60938d20
549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e
64c5309cb3d2245b3dfadf321296c8a7cf86c9ae33764e09a41932c3c4fc823e
94d90e7f0577f2e80461a2eef2bfe4710a6e1afddb6bb2b0585610c1dda0beec
SH256 hash:
91b7380505157f40c574254f7371c6ddf6cf01fdb4914b7381904b94bf404373
MD5 hash:
678c6702aee668dbcde3082290031100
SHA1 hash:
bf315d182181c37a07ba3de3d9fcf0fb23eaa2ac
SH256 hash:
2504b296cacf0e0776bc50f8d05ba3121be06fae87bb4713372aebf81339425c
MD5 hash:
4e8fdb995f3c7ca9938806061b07449b
SHA1 hash:
aa3398bc63b1e5bafdb9e1423ddff9253b41627c
SH256 hash:
549babb526332bc84aeab495b8b99982c30497716142c317e13fe3e96cf7188e
MD5 hash:
818ddb3d73670d6ed670bd689d481cca
SHA1 hash:
51f05219c127a40e6054bdad597a4c8adf306f08
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.