MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c
SHA3-384 hash: e8bc4457cc7ecf8d0405dcdcac9cd821632fc1beb2a64e9ddea2ccc71de1aeca87071b06f7fb6e21f36887a27a3dafc7
SHA1 hash: 95a3938ad2c57330cca719cca5f9ec5ffacfd3ef
MD5 hash: def265ed30f305eca30d450ff9609587
humanhash: social-queen-potato-hydrogen
File name:def265ed30f305eca30d450ff9609587.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:393'216 bytes
First seen:2021-09-29 17:44:34 UTC
Last seen:2021-09-29 19:06:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 17a1fa7a17d3ddbef1b7dbee846d558e (4 x TrickBot)
ssdeep 6144:ZvxsZNEIOAorbtYrHY+y1h0mEqe3MW5yX/+wloufsYPOHxCiG:9xs5orerHX1v8We+wKuDPuMiG
Threatray 3'680 similar samples on MalwareBazaar
TLSH T12784E10271E988F2E2B299300DB56B35AF36FD744F71CB8B2354961E1D364958A3B363
File icon (PE):PE icon
dhash icon 18f8bac6e66e7818 (4 x TrickBot)
Reporter abuse_ch
Tags:exe lib155 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
def265ed30f305eca30d450ff9609587.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-29 17:55:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c9ddce58-d1e5-47fc-8df1-be1598dc333b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193246/
Detection(s):
SecuriteInfo.com.StaticAI-SuspiciousPE.20786.23393.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3e5dae62-4a53-481c-9817-6eb744e4ece0
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/861258
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-09-29 17:45:05 UTC
AV detection:
5 of 45 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kxblqjztqxj2ctk7xtfgecnddicaeoggk237ixzboru7iewu4kga._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
16f5c54bb382796b4e1bac32286ca9d8fd795564e689f8c69fc3c4de036359ff
TrickBot
226321291fa1d596e9a0dc89992fc3e36eb070d06c02df249593a3193d216ed3
TrickBot
5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49
TrickBot
6c238a124150dc1298bd6a347e8628b51ca2d5ae04b0181270a5928aedc63ad9
TrickBot
d123ffe07c4db0343645678c0ea21a4201debded89f22ca043cf336a77f6a082
TrickBot
e5189997d295c9353162b5eebf001413df093a774cc7edabd67e9f23daa3a112
TrickBot
f50b51b633835edd334b8627e2cac0571b856212ec2580a7aeb149bd27066255
TrickBot
+ 3'670 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib155 banker trojan
Link:
https://tria.ge/reports/210929-wbqjjsfdg9/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
f9b8486bb9309201ab1b7a75e4e10066361c3f47037e8f3112c8a9590120395f
MD5 hash:
09240d22d256f68513f0d6d650d888b8
SHA1 hash:
dd7157222ae0a541e1b6423c2a3d250e47a5f657
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/89b27f60-e939-454c-8276-0348d345d0bb/
Parent samples :
55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c
e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8
012ea56386ce7509c1950a04da161e76535ae5aaf1f834eedc94c84a18ebdb47
SH256 hash:
fbc0ddd90d93fcc3fbd450bbd4b3de790ae19c1ddef8b9be4338eacaf646bb88
MD5 hash:
b6fe5e0e8a0a0703396f661046f00b84
SHA1 hash:
74ac85dd55e7ff2d96e542bf89c3916dd2b5c3ca
Link:
https://www.unpac.me/results/89b27f60-e939-454c-8276-0348d345d0bb/
SH256 hash:
d8cfa7f2c2fd9e491e99bec518197528cd737477ca8194a35dfc885caf986f9a
MD5 hash:
adb891461f1ff1c9f176bdb92892a212
SHA1 hash:
1ebf2b98b5c0489af19bfc5a4bf63f5c17d1dda7
Link:
https://www.unpac.me/results/89b27f60-e939-454c-8276-0348d345d0bb/
SH256 hash:
55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c
MD5 hash:
def265ed30f305eca30d450ff9609587
SHA1 hash:
95a3938ad2c57330cca719cca5f9ec5ffacfd3ef
Link:
https://www.unpac.me/results/89b27f60-e939-454c-8276-0348d345d0bb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/55c2b8273385/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/193246/
  
URLhaus
https://urlhaus.abuse.ch/url/1641957/
  
Delivery method
Distributed via web download

Comments