MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af
SHA3-384 hash: ec2ba38fc240f4e6b194b900995254925026903e862ddaeee750daee4ce7c5967aa3dcece68f9fd8349421ab949963fe
SHA1 hash: 44c3ded84a7adcc1ccd1e82b8cff2bd1e6b6c9c2
MD5 hash: 29e588464e6e7b3d9aba0267556ab042
humanhash: edward-magnesium-red-finch
File name:29e588464e6e7b3d9aba0267556ab042.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:450'560 bytes
First seen:2021-10-11 08:16:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f8cb6cf7a746c79f8c917be532cea46e (8 x TrickBot)
ssdeep 6144:X9cZrtODhev9zIVcSYkh2Kb//xHEZ0rmMTG9VVwF85HA5ke1W1DJSqFD:tmIDhMkB/xkOF0LNA5W1D5D
Threatray 3'926 similar samples on MalwareBazaar
TLSH T1FDA4D023F1E4C8F6D1F702700EA65BA9B77AFC10CBB0EA5753805A5D1C76A858923367
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
257
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
29e588464e6e7b3d9aba0267556ab042.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-11 12:21:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4c066021-b7b9-4b97-93c8-a33705226abf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196523/
Detection(s):
Win.Dropper.Zusy-9901116-0
Create hunting rule

Win.Dropper.Trickpak-9901205-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware2.21815.7403.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/6163f3001c2d58ba74016b5e/reports/b3f171bb-ef0f-47f0-b07c-dfedd7cd4625/overview
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/868100
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-11 05:21:26 UTC
AV detection:
21 of 45 (46.67%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f
TrickBot
295a8418d504dd81e1066eab3e78924fb107e3f74301f56be89544e942c19b9b
TrickBot
491c684460b41e06321c3589818a48e376b4a2c9028ae88e0c16050919e13ecb
TrickBot
620255bf64d796af1335256a9d9314e393631ca793c1ace9f3a9b04552c42d7f
TrickBot
7329669d8afc510a838f43ca91821e5b01c157fb397f1f347490b4e028bbf6eb
TrickBot
8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
TrickBot
969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6
TrickBot
d4fa44048095c1177007ec54df4b73e6a70e8b092718605eef93a573c79a54af
TrickBot
+ 3'916 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot161 banker trojan
Link:
https://tria.ge/reports/211011-j6pjhsgfb5/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
6be1536366ba4dc030996d349d47b88dc65e28af044f64fcfe9c474fd40a19c6
MD5 hash:
714ec938834f72bf8c895fda38b55d1b
SHA1 hash:
4cce5c6df9c8782640b7304d62ec2f633970d81c
Link:
https://www.unpac.me/results/16162028-b3be-4e5a-8f54-029d14e4e237/
SH256 hash:
7c6874264ee9147b8dba66b0dcc7bcce13e61cbc8939326b6aa74f25e382a97d
MD5 hash:
ef7a11114f03b52b1a5b8c7fbd6791e5
SHA1 hash:
444e1ef3958e5e36b036ea8e3eb51a1ebffa48ab
Link:
https://www.unpac.me/results/16162028-b3be-4e5a-8f54-029d14e4e237/
SH256 hash:
a1e2bd1ddc025e9637ebd2b24597f619918729a0ce34249544929b9b8525adc9
MD5 hash:
228b1d0eac9a1c6f0fa5fc277e6d3ce7
SHA1 hash:
05e386ae34e72fca14f46a7beeccce3c573b8da6
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/16162028-b3be-4e5a-8f54-029d14e4e237/
Parent samples :
d4fa44048095c1177007ec54df4b73e6a70e8b092718605eef93a573c79a54af
7329669d8afc510a838f43ca91821e5b01c157fb397f1f347490b4e028bbf6eb
6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af
abcd70d150c7f460719491d31d5e1278e43ba75c69c4b1a84de9de00f5d13af4
SH256 hash:
6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af
MD5 hash:
29e588464e6e7b3d9aba0267556ab042
SHA1 hash:
44c3ded84a7adcc1ccd1e82b8cff2bd1e6b6c9c2
Link:
https://www.unpac.me/results/16162028-b3be-4e5a-8f54-029d14e4e237/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6f01fb100687/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 6f01fb1006876b55e929c9bd408d7188ea789107e40af9ab891eaa99dbfd68af

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1655281/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196523/

Comments