MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 13

Intelligence 13 IOCs YARA 1 File information Comments

SHA256 hash:	5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
SHA3-384 hash:	847db2f8af1d999f9324d86eaec54fb23d1dd06ae90ac527d457ae92cb11ce1e23fe9c76a7a59b4901bc18c58ffc4a29
SHA1 hash:	315ee77a118478f707092d3eeb29fb320849d2b1
MD5 hash:	81e713ad070459e013fa94d1ca56c035
humanhash:	juliet-mirror-early-princess
File name:	81e713ad070459e013fa94d1ca56c035.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	753'664 bytes
First seen:	2021-10-05 17:19:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0f4296a776e183d43c9748b7869d4228 (9 x TrickBot)
ssdeep	12288:vJMtObg6CM2wUbyh/pSRJlW96QZk6BSb9XQox4e6oqu:vTbxCM2rc/asL/Bo9XQ64f/u
Threatray	3'878 similar samples on MalwareBazaar
TLSH	T106F4AE0631D0E1BAD5E321B4CED1EB3956F9DD9287290BCB6B81F91E6E326C0453B712
File icon (PE):
dhash icon	71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter	abuse_ch
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

428

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

81e713ad070459e013fa94d1ca56c035.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-05 17:37:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e35d41a0-35fa-4c6a-8bce-165c36a9d381

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

TrickBot

Link:

https://www.capesandbox.com/analysis/195152/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.10961.12896.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware keylogger packed

Link:

https://www.filescan.io/uploads/615c8948e3d213d202b7af5e/reports/c39ab772-334f-4562-b048-3fc8c1d83e87/overview

Malware family:

TrickBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1fc09b86-6a8f-4ddb-94ad-d9b8ae659195

Result

Threat name:

TrickBot

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/865004

Signature

Allocates memory in foreign processes

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2021-10-05 17:20:08 UTC

AV detection:

15 of 45 (33.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lysg2fzczfcmhfbhhgqfal6xbymsukp6edol5efennu4j5amjztq._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e

TrickBot

474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1

TrickBot

5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2

TrickBot

9a5d5f4144492833b2f5368bf39154e0a5d60914afccbfde1db93cf0cd9db000

TrickBot

9ef22f6e73a5eae7a8d1f9fb682e18a413d3081f418238ad16c682d662fb12e9

TrickBot

abd7a64e1bf9248c1e53f32ea222a1e448132346edb55a3dbca55354bc3488d1

TrickBot

b88d012225e5e8af014bea93cd04c3655f9b46c77f06557a857868ceda46153a

TrickBot

c6ea628cd3252582504cdfd64aafd7f44711822c90d0ac1e3deddb7fa3ece997

TrickBot

d76bcc765a822ded81cf1518ab3d65e08cc42ccf946d9381d1115934abe6fed5

TrickBot

+ 3'868 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:lib159 banker trojan

Link:

https://tria.ge/reports/211005-vwe3waaear/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Looks up external IP address via web service

Trickbot

Malware Config

C2 Extraction:

179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443

Unpacked files

SH256 hash:

fd752504562267f2e4753884fb70852bc424973ef6ca377fe393adbfe3612555

MD5 hash:

a15a407ae0533a8329c0e5d196ee5c04

SHA1 hash:

948db2b94d7fec0108eda19aa0c23268932d1c4d

Link:

https://www.unpac.me/results/a376786f-8242-461c-91e9-6ceda4253d42/

SH256 hash:

23552087f88bd9eaf2910a5ff75e63fc6b23b19ccd79c457b5065a3876f654a3

MD5 hash:

1fc9efed511a8f773868a03b7cc19154

SHA1 hash:

1a7eccbddcaec7d67b358ea586757a8f3a579906

Detections:

win_trickbot_auto

Link:

https://www.unpac.me/results/a376786f-8242-461c-91e9-6ceda4253d42/

Parent samples :

474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54

SH256 hash:

b15a0b17cdabdfc048ecb0abe2efcfc85e3c076689f21250a6df7379ff51ed0d

MD5 hash:

4fe2a1f91c8dbaeec979a8ec3bb103b8

SHA1 hash:

dcf3f5811771ed132405e50a0108feea5fb12236

Detections:

win_trickbot_auto

Link:

https://www.unpac.me/results/a376786f-8242-461c-91e9-6ceda4253d42/

SH256 hash:

5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67

MD5 hash:

81e713ad070459e013fa94d1ca56c035

SHA1 hash:

315ee77a118478f707092d3eeb29fb320849d2b1

Link:

https://www.unpac.me/results/a376786f-8242-461c-91e9-6ceda4253d42/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/5e246d1722c9/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.