MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 607ae69db9a94f6c75a215adcd1a9ffbdd4a66c09ec0d50f274f83cab8ad58f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 607ae69db9a94f6c75a215adcd1a9ffbdd4a66c09ec0d50f274f83cab8ad58f2
SHA3-384 hash: 65f19414bf63e4266f126509c449ac4cc302d1b4c9601575a7b2c964883f706b12014e8248f53e8237797c435cf81c0e
SHA1 hash: 341533cf70a4f74f3bf9313ba9570d7930bb2f9b
MD5 hash: b3de5e4b04465abeff5029931234f2b4
humanhash: gee-tennis-quebec-north
File name:unpacked_trickbot.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:136'704 bytes
First seen:2021-08-19 05:07:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:NmaqGWRBN0X9P1vrZoe5+u501qurb2YZhcRn2xCUKGWG:NsBOWez0zh9xCU3W
Threatray 16 similar samples on MalwareBazaar
TLSH T165D35B0DE6C3C2B5EF8601B0072FB37F597596016B1799C3C7A59C20B9106E2673EAAD
Reporter ankit_anubhav
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
unpacked_trickbot.dll
Verdict:
Malicious activity
Analysis date:
2021-08-19 05:10:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5e2b2d67-6e9f-41be-8976-265b357cfe7d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/180508/
Detection(s):
Win.Trojan.Trickbot-9833091-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b1d8e360-ba87-40ba-bea8-5661a8b417a0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/835497
Signature
Antivirus / Scanner detection for submitted sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/607ae69db9a94f6c75a215adcd1a9ffbdd4a66c09ec0d50f274f83cab8ad58f2/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-08-19 05:08:07 UTC
AV detection:
23 of 46 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mb5onhnzvfhwy5nccww42gu77pouuzwat3ankdzhj6b4vofnldza._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
003af0a8411a8f280a4af0c3ab807b0572a7dbbc782c4f007fcb7889bd683e9e
TrickBot
25939f03c43151ec5474f746fc71510fb6abe8b5e41da44fef74b6bc806e26b4
TrickBot
4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9
TrickBot
6dba263acd0c1adf448036202c6a8a85fe4e50649bae213c620550e39005fefb
TrickBot
a67c82a1a2170e3e7c047133489867f844674009720628058aa7d9299b2b89ab
TrickBot
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
TrickBot
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
d314ff883243444f1853614759a5ec7af96a1829cebdeaa283fc1051e4261ffa
TrickBot
e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
TrickBot
+ 6 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob122
Link:
https://tria.ge/reports/210819-7kcp6qcczs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
607ae69db9a94f6c75a215adcd1a9ffbdd4a66c09ec0d50f274f83cab8ad58f2
MD5 hash:
b3de5e4b04465abeff5029931234f2b4
SHA1 hash:
341533cf70a4f74f3bf9313ba9570d7930bb2f9b
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/5a53f8b7-fe9f-45d1-a21c-31fe4c585743/
Parent samples :
82576d0e8b54901d195af6f1f724e7689bdf1b3edac3aa51e118637163eed8f4
607ae69db9a94f6c75a215adcd1a9ffbdd4a66c09ec0d50f274f83cab8ad58f2
cb6a51b8a047de08fb4bfa7031bd1c917600e55c28f941a1da520e622c29f6a5
2c672c1537655f77a4f7df0b300aaf54f1a8af6f8dfc72475441020721aed575
9c8e26bdf89634254162a5529bd2c8c3bc4c2215be3d7cb39a47fcd0327c045d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.19
Link:
https://yomi.yoroi.company/submissions/607ae69db9a94f6c75a215adcd1a9ffbdd4a66c09ec0d50f274f83cab8ad58f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TrickBot
Create hunting rule
Author:sysopfb & kevoreilly
Description:TrickBot Payload
Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.trickbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/180508/

Comments