MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19
SHA3-384 hash: c393e284bb15cf0d1ed63c1372bcd36a4552e111127b0f9fd9702f8fc64148716a3f8450833a069699ac87fc4546b85b
SHA1 hash: 3203d549b071d092f2ff45d33a1b34cf904d3b58
MD5 hash: 5ab590b49b70c8e70269325d6c039cec
humanhash: echo-avocado-delaware-fifteen
File name:5ab590b49b70c8e70269325d6c039cec.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:753'664 bytes
First seen:2021-10-06 17:59:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0f4296a776e183d43c9748b7869d4228 (9 x TrickBot)
ssdeep 12288:dBx+M4F6CM2pEbihXZGrV+rtz0rAK97lF/ACLy/Yw:dn4gCM2GMXBZK97H4CLyQw
Threatray 3'967 similar samples on MalwareBazaar
TLSH T180F4BD0631C0D07AD5E221F1CED1EB295AF99E928B290FCB7B90F91E6E366C04437756
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
428
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5ab590b49b70c8e70269325d6c039cec.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-06 18:02:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2696f19d-efd1-43e9-bbd3-b8b29d7978f6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195517/
Detection(s):
Win.Malware.Generic-9899479-0
Create hunting rule

Win.Malware.Generic-9899480-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware1.17532.18320.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/615de434e3d213d202b8c11d/reports/e47a79a1-c278-4816-909a-0c306c9f1573/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/57c393f9-d386-4b80-9c3d-144644aef4a3
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/865769
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 498197 Sample: HI3SC6KpTM.exe Startdate: 06/10/2021 Architecture: WINDOWS Score: 100 39 57.143.129.102.zen.spamhaus.org 2->39 41 57.143.129.102.b.barracudacentral.org 2->41 55 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->55 57 Found malware configuration 2->57 59 Multi AV Scanner detection for dropped file 2->59 61 4 other signatures 2->61 8 HI3SC6KpTM.exe 2->8         started        11 cmd.exe 1 2->11         started        signatures3 process4 signatures5 63 Writes to foreign memory regions 8->63 65 Allocates memory in foreign processes 8->65 13 wermgr.exe 4 8->13         started        18 cmd.exe 8->18         started        20 conhost.exe 11->20         started        process6 dnsIp7 49 191.36.152.198, 443, 49749, 49750 VIPTURBOCOMERCIOSERVICOSDEINFORMATICALTDABR Brazil 13->49 51 179.42.137.105, 443, 49808, 49810 TelefonicadeArgentinaAR unknown 13->51 53 7 other IPs or domains 13->53 37 C:\Users\user\AppData\...\HI3SC6KpTM.exe, PE32 13->37 dropped 71 Hijacks the control flow in another process 13->71 73 May check the online IP address of the machine 13->73 75 Writes to foreign memory regions 13->75 77 2 other signatures 13->77 22 svchost.exe 11 13->22         started        27 svchost.exe 13->27         started        file8 signatures9 process10 dnsIp11 43 109.87.143.67, 443, 49902, 49913 TRIOLANUA Ukraine 22->43 45 178.151.205.154, 443, 49896, 49907 TRIOLANUA Ukraine 22->45 47 10 other IPs or domains 22->47 29 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 22->29 dropped 31 C:\Users\user\AppData\...\Login Data.bak, SQLite 22->31 dropped 33 C:\Users\user\AppData\Local\...\History.bak, SQLite 22->33 dropped 35 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 22->35 dropped 67 System process connects to network (likely due to code injection or exploit) 22->67 69 Tries to harvest and steal browser information (history, passwords, etc) 22->69 file12 signatures13
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-06 10:44:58 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
3816e3845184a41e9c7a1bcb9dacd089e712f72fff6f44ab4d55d563b0177652
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
3cff8842d7b2da479a8dcd6c930706d2df7550f9931cefdc94979f03d256f718
TrickBot
474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1
TrickBot
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
TrickBot
5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2
TrickBot
728aff0d54df55bd4ed10a1c02c165e86310503cf82bd4c2d6b4b2a0a383dabd
TrickBot
790769e6e3eb9d2d5d70b03c8d5e0728e954a2bcdd3625b87fd3366b961b90a7
TrickBot
9ef22f6e73a5eae7a8d1f9fb682e18a413d3081f418238ad16c682d662fb12e9
TrickBot
acf725f1ade6bcadcb9f0ded2d0ad8e6cac553a19acbaf67dd95c133623594e4
TrickBot
+ 3'957 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot159 banker trojan
Link:
https://tria.ge/reports/211006-wle6kabgbl/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
14ebe391b5c3b3ca0ed5c108760a61a22e5778285ff78155325a1ba549f77bb8
MD5 hash:
c3b5502ed5aaef9753a310397c886e8e
SHA1 hash:
71656be51cc995f4a0a35a6eea64123a18ad22f1
Link:
https://www.unpac.me/results/8c58e23c-34b1-451a-a95f-ff9f780b7a76/
SH256 hash:
c0feeda957a22edd29aec47be67682e2f4e27a3caefe59eb0d7f05af6fd0de2c
MD5 hash:
72c26a8f385c8941dd42a864b580513b
SHA1 hash:
20ec16d52b4964dc431b3841a784dfa112712d61
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8c58e23c-34b1-451a-a95f-ff9f780b7a76/
Parent samples :
acf725f1ade6bcadcb9f0ded2d0ad8e6cac553a19acbaf67dd95c133623594e4
9ef22f6e73a5eae7a8d1f9fb682e18a413d3081f418238ad16c682d662fb12e9
790769e6e3eb9d2d5d70b03c8d5e0728e954a2bcdd3625b87fd3366b961b90a7
728aff0d54df55bd4ed10a1c02c165e86310503cf82bd4c2d6b4b2a0a383dabd
3cff8842d7b2da479a8dcd6c930706d2df7550f9931cefdc94979f03d256f718
6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19
76e78467254c1222cf7d03484a2584a707fdcaa9ffcab2b7323a2958c72667f4
SH256 hash:
4e58a4fbba6ef8a9d5916a2e0af3dd06084b4e5793216670ecc3d6890dadb898
MD5 hash:
1ecbde47aff9f1db8b3368bf83e3bf71
SHA1 hash:
cc640a536125fb0a249ee020a2c569a5bb4bab6a
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8c58e23c-34b1-451a-a95f-ff9f780b7a76/
SH256 hash:
6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19
MD5 hash:
5ab590b49b70c8e70269325d6c039cec
SHA1 hash:
3203d549b071d092f2ff45d33a1b34cf904d3b58
Link:
https://www.unpac.me/results/8c58e23c-34b1-451a-a95f-ff9f780b7a76/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6b5e36ec4ea2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 6b5e36ec4ea2340e436834152936879db405fecf701801d88cbb6ca200fc5f19

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/195517/
  
URLhaus
https://urlhaus.abuse.ch/url/1655281/
  
Delivery method
Distributed via web download

Comments