MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 580a18b16318da94712bc81bde2bfc83c0871063b13638fdff09b82fac75e304. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 580a18b16318da94712bc81bde2bfc83c0871063b13638fdff09b82fac75e304
SHA3-384 hash: d0dfa2e562b4e923ed3921af045060b36227d86a91081f8b9d5c186700efe0690280f4ec79d1a65bc186fd343817e342
SHA1 hash: 00bed0ea2d76eebe9bbf94c89da306b311d3bc4c
MD5 hash: ba67e2e485250c0eacc244ca012f4bda
humanhash: solar-alaska-lamp-hotel
File name:580a18b16318da94712bc81bde2bfc83c0871063b13638fdff09b82fac75e304
Download: download sample
Signature TrickBot
Create hunting rule
File size:638'976 bytes
First seen:2020-11-07 17:39:30 UTC
Last seen:2020-11-07 20:07:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4fd6746c3baec3c98af27e5a347d7054 (12 x TrickBot)
ssdeep 6144:CPVJEkx22mkaQVUUpYLPrO5fylHMwYpd8pJgpZqvNqV14UKQ0Xae8mzSZ/gYw03J:C/9gh8ylHMGsXKQ8a3muZ/gYoBWo3m
Threatray 119 similar samples on MalwareBazaar
TLSH 6AD47C33F541758AE53340B10D75ABF93E2A3C356025924B76C0AE9A99B2ED3BC0931F
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed.140.18015.2680.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Connection attempt
Sending a UDP request
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/580a18b16318da94712bc81bde2bfc83c0871063b13638fdff09b82fac75e304/
Threat name:
Win32.Trojan.Bsymem
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 17:45:49 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lafbrmldddnji4jlzan54k74qpaioeddwe3dr7p7bg4c7ldv4mca._file
Verdict:
unknown
Similar samples:
040274352428ade251917be7b4d4df75ff7c79e868a030d066d681587b29f6b0
TrickBot
0dc93ed0d66908d000b3690bad38429c220c089a891972b10b17fcc0acd7aad9
TrickBot
23315d8eab76bdf171f6021f6b0848654cbef87e1cd9c8be2b3a349744ba2c13
TrickBot
6a97d38985a7092cb2ea00720fb817086687061b6d6de9752a8b7b7b9b6c4846
TrickBot
7b965f905779d5a9c63dfa9a9baa9f55e48901bbc7924510b0e8e2c4b21b257a
TrickBot
800403949e76ea5119dbca660ef59120b819557a9db2208dd52345855399c0b5
TrickBot
b89e3c01c95337c6976cfdbc20163b4375eb1a0a76a87335e891fcd932c361d1
TrickBot
dc7bbcc9be5194ef0cc6ec9de42efab4c6e0fa1c681207887e51fe4e19d970b1
TrickBot
e69837ab3c5b734527ff827b4c6f5e10aeb8fdf703cc03a03fca3b5922a52cd0
TrickBot
febb5761ae671c134bac0b2542eeecd8c0cd779524fe3c64717f4160e1fbd375
TrickBot
+ 109 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib751 banker trojan
Link:
https://tria.ge/reports/201108-kzc37ch8ds/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments