MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6952da5cbad1a97c504747baeb0f42391c78567b1f70bdeab2a8c60c1b28f39d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6952da5cbad1a97c504747baeb0f42391c78567b1f70bdeab2a8c60c1b28f39d
SHA3-384 hash: d643aa6adc7aff66b802f493ccaabe9510253320f73b5e0af0a6f1b5bdac03cb1e51fff7a6fa00a392fc4ce618ea28bd
SHA1 hash: 7930f60f56d38aa88df989ff1a2a20f9c48cdd16
MD5 hash: 87499d4de23f2905a49302a75eeddc67
humanhash: alaska-lake-kilo-mississippi
File name:6952da5cbad1a97c504747baeb0f42391c78567b1f70bdeab2a8c60c1b28f39d
Download: download sample
Signature TrickBot
Create hunting rule
File size:201'216 bytes
First seen:2020-10-24 21:04:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:m2HzxtU5YU8Km5cFk1oOG5UP2s56S9NuEI+BclqSHJiYs4hw13tuv4X0k32KZz2h:VTrrDImkq0JiYsfcunGKZz2
Threatray 2 similar samples on MalwareBazaar
TLSH E1145A0AB1E400F8D567D179DB8B821BEAF27085032197DF17A08F655F13BE6A93D346
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75253/
Detection(s):
Win.Trojan.Trickbot-6335811-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/508713
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6952da5cbad1a97c504747baeb0f42391c78567b1f70bdeab2a8c60c1b28f39d/
Threat name:
Win64.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2019-07-26 02:56:05 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
261e6a161980bf628360fc371e791ccd31740ec571ebd523e742404e350ffb05
TrickBot
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a
TrickBot
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201024-ppccwccgwa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Malware Config
C2 Extraction:
138.34.32.218:443
85.9.212.117:443
143.202.145.43:443
198.53.63.120:443
158.58.131.54:443
87.117.146.63:443
118.200.151.113:443
36.67.215.93:449
41.211.9.234:449
178.78.202.189:443
200.2.126.98:443
212.225.214.249:449
180.241.112.37:449
148.66.40.98:443
177.36.38.19:443
182.253.210.130:449
77.89.86.93:443
47.49.168.50:443
70.79.178.120:449
68.109.83.22:443
24.231.0.139:443
84.237.228.13:443
96.43.40.221:443
109.234.36.8:443
195.133.145.121:443
92.53.91.236:443
185.251.38.194:443
89.223.92.87:443
92.38.130.196:443
85.143.218.85:443
Unpacked files
SH256 hash:
6952da5cbad1a97c504747baeb0f42391c78567b1f70bdeab2a8c60c1b28f39d
MD5 hash:
87499d4de23f2905a49302a75eeddc67
SHA1 hash:
7930f60f56d38aa88df989ff1a2a20f9c48cdd16
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/767b5dcd-a4f2-4c5d-a6df-513cbdcdd75f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6952da5cbad1a97c504747baeb0f42391c78567b1f70bdeab2a8c60c1b28f39d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75253/

Comments