MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d7a49cdac978216e86a870c681ee52fbe0cd292b3c3373b96810eb419ddcfcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d7a49cdac978216e86a870c681ee52fbe0cd292b3c3373b96810eb419ddcfcf
SHA3-384 hash: bf88b935964872086cb5b612aa50119262ac7c8607261a5f8cecf1f8cd37999c0c42e2073163ba7bd5cd9e249cadfcb8
SHA1 hash: cd03fc628055bda69e2bce2f93bdc3c388760eaf
MD5 hash: 4c8ed415cb607e382c94cea86e9ac4ce
humanhash: aspen-quebec-missouri-jersey
File name:26EYJSFYHMS.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:766'017 bytes
First seen:2020-05-05 04:57:48 UTC
Last seen:2020-05-05 15:58:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 30625d671f2d3abf2a3e2df54581f47b (312 x TrickBot)
ssdeep 12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOml
Threatray 4'788 similar samples on MalwareBazaar
TLSH 8EF4B32F8EBC4E13E5D4C2F03E368E5CA6D65C19F84C65AE53043E8A2E637322D5456E
Reporter JoulK
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.20ee34e01ac25807.25233.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 01:14:23 UTC
File Type:
PE (Exe)
Extracted files:
30
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
16f74973aeb99c37d5052e1378a6b12d152429c5c51e28b6586f7a4d06569d9d
TrickBot
4b8ea8e187228e42448858632ecc106e83bdcf3cd2f355951ff6ae5268998f2a
TrickBot
5270f853525007c98aa19fec31af07d7f28f73ac2e1f099b6a8c341d5582c911
TrickBot
674d541765e386af1495e1bea022b53675495493baadad3cd7acfe03c2d55bd0
TrickBot
6f3e31ae04fa50002156ac90b1623d95fe5d8c7ab679d61e5b33c17bb83c8f0c
TrickBot
7507202c4c10570e48cc55e0d72c86340c5b9834764217d109abda6ce187ffda
TrickBot
a67c132773545a7fd5a2d9141145190bf3c39df7d03967665f2f6a2ad88ae70a
TrickBot
a688773157403e0f8d6054f23399a6c0b49eff6297e1845d1f3601ef212a5267
TrickBot
b9584bc752d123793d82fdfb8773d8ca0b03aa490d61dbecd3d5f584e67e3379
TrickBot
e993c039ee9d48f42afcc9425ef7ceafe3814e60ea87b43ec1f004e7313e2622
TrickBot
+ 4'778 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:ono41 banker trojan
Link:
https://tria.ge/reports/201109-pc4zkn3sxj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 5d7a49cdac978216e86a870c681ee52fbe0cd292b3c3373b96810eb419ddcfcf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/357793/
  
URLhaus
https://urlhaus.abuse.ch/url/358097/
  
Delivery method
Distributed via web download

Comments