MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5929445eb9941a91426eb0cc13cf918649608a1e2772d283cdc83665d82d400a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	5929445eb9941a91426eb0cc13cf918649608a1e2772d283cdc83665d82d400a
SHA3-384 hash:	d46b433f02fb406a35c143d9cecd30931e8ee03b271599cd1a5ce9d43deba5b930315c314dbeb979347b0320c067ea0f
SHA1 hash:	fa8409bcd758bbd92bc01f7961e2f844c36badc9
MD5 hash:	361e8f325798c47073c2f5f2f9f69aa2
humanhash:	social-nine-river-utah
File name:	9980m9n7wy.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	417'169 bytes
First seen:	2020-07-17 16:38:29 UTC
Last seen:	2020-07-17 18:10:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3646860cd33b36d7cd5cb0909734f082 (1 x TrickBot, 1 x Conti)
ssdeep	6144:gZT+AHf3zYVxZtmHvvpTStr6bI4SEpiH0Bjvx0QoN3VhOsTPO:gZTZ363EvvZS8iEpiH0Bj50FV8sTm
Threatray	5'017 similar samples on MalwareBazaar
TLSH	A894E0013BD58431E4B3523149AA9232223EF9718FB2579FB7986F4D1DB45C0AFB6362
Reporter	James_inthe_box
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

117

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/27497/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

PUA.Win.Adware.Bang5mai-6804572-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Connection attempt to an infection source

Result

Threat name:

Trickbot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/389176

Signature

Allocates memory in foreign processes

Delayed program exit found

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/5929445eb9941a91426eb0cc13cf918649608a1e2772d283cdc83665d82d400a/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2020-07-17 16:38:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Verdict:

malicious

Label(s):

trickbot

TrickBot

0d94462f293a6a366797348ae505498819f598a7e406678d904064a0a4849f98

TrickBot

10a0cdd0253d5747a6d4c5f409247c893a2d67a6e7624008dbc42fca3b3fc789

TrickBot

3346b8335a4cf275625e542dff2f3e2b9a9f7748cec2ceb80cfb0ab7789fc0d0

TrickBot

67e88a34b883c76e3002f09b021177554a51808c1d6a9e9ece620562d14b0d2f

TrickBot

734b259f20b4989df93555fde599b5ea9375a7c10f9e6abadb856bfe54343ec1

TrickBot

9a1fc2de129a140468451b41f79bd76f056f790550a500909f67cf009419a717

TrickBot

a3f763c730e23fab3523b4a501f4590abcc4fd20306cba116c3b726a0d198367

TrickBot

a4bc3940af545287d13414a00eff2f902f8ca487fe2f9ecdbe14e583a15d6d08

TrickBot

fcb388181e1e495dd7ce262309dda474a74a63e66955bfc463fe0f51eda0212c

TrickBot

+ 5'007 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

trojan banker family:trickbot

Link:

https://tria.ge/reports/200717-3plaaspdgn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Trickbot

Malware Config

C2 Extraction:

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5929445eb9941a91426eb0cc13cf918649608a1e2772d283cdc83665d82d400a