MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361
SHA3-384 hash: b10dec241e586f3e2c07169ffc2ec841db43e7ccc42cec5724a60c9b4a356cfecd464d3d2284de67c553114142e0a454
SHA1 hash: 2fafec7f6d5da682e3d9f945edd258f080cd2797
MD5 hash: 157c7f70ff6dc342506d9dd269c10950
humanhash: virginia-finch-india-jersey
File name:157c7f70ff6dc342506d9dd269c10950.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:692'267 bytes
First seen:2021-10-29 05:29:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7ffe85aa6061465054775c61556ce3a7 (3 x TrickBot)
ssdeep 12288:0bJ2lCSCeOVkk+8x2fU3JXeqZNEo9v3cOvhkMDfdil/Cxofh/Q:vCeOVv+8xtHEqcMyEfdqCxofh/Q
Threatray 4'219 similar samples on MalwareBazaar
TLSH T152E4EFA17B95C1B7E6B201750FF63B3596FBE9600F207BC323844B5C5A328D14A3A766
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/596ac77b-7bf4-4b5a-b249-41a4fa064c56
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/879023
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-29 05:30:06 UTC
AV detection:
21 of 44 (47.73%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941
TrickBot
061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565
TrickBot
074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206
TrickBot
1309cc563fba424dfbf77e08438fa80738a269bc86e46ca9c3f374b19fecb181
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e
TrickBot
f05c92792d04b23c27f7be6a5fbb318c77acd998d2ada2823e0ae62d05adb0af
TrickBot
+ 4'209 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lip142 banker trojan
Link:
https://tria.ge/reports/211029-f66agscfa8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
4e94134e1104bff113f31ec83ae3b0e143c6e3663272cd8c28554ad136d09271
MD5 hash:
0fc0d76761f8bafca954cb7fdc172eb4
SHA1 hash:
a451fe8dc546b939d95b67c87c0a9d9c40409288
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d62b928d-fb56-4eb0-8851-c9ffb5e5d40a/
Parent samples :
bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc
734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361
SH256 hash:
1dcacacccff1eaa12757dde24b8125272c07ff1def6289ceeefd1dce5b51019e
MD5 hash:
211540344b333258bfe82318f6a3a62a
SHA1 hash:
6b91ee700b4ac688a07e903a750dbc3cc0dbcaa5
Link:
https://www.unpac.me/results/d62b928d-fb56-4eb0-8851-c9ffb5e5d40a/
SH256 hash:
c202dccf5147a8e294bab1a01ebf3d4d240b5854454ddfb68fad2ec7af9fe9cc
MD5 hash:
56217e982a17c346c7d4701a623e24f5
SHA1 hash:
0332bc92a697b4be2047f755de84c1cb2959225a
Link:
https://www.unpac.me/results/d62b928d-fb56-4eb0-8851-c9ffb5e5d40a/
SH256 hash:
734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361
MD5 hash:
157c7f70ff6dc342506d9dd269c10950
SHA1 hash:
2fafec7f6d5da682e3d9f945edd258f080cd2797
Link:
https://www.unpac.me/results/d62b928d-fb56-4eb0-8851-c9ffb5e5d40a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/734f8fbef8f8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1698135/
  
Delivery method
Distributed via web download

Comments