MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 9
| SHA256 hash: | 77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3 |
|---|---|
| SHA3-384 hash: | 0c4f6c5fb292f997dc82137bbc735c4a894b47a6ab54f10b16d57535916538aedbb4e33909d5446a17cd8c76aaf8829b |
| SHA1 hash: | 9a06574b7f9f732cf6265fe0aff4c133c1cb8314 |
| MD5 hash: | c252603232987121f642be93e9e39348 |
| humanhash: | quebec-yellow-north-cold |
| File name: | c252603232987121f642be93e9e39348.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 675'899 bytes |
| First seen: | 2020-11-19 09:18:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3d6dd54dbc20ca02e6f52d722b7724da (1 x TrickBot) |
| ssdeep | 12288:6EvuYB/r+XfQzgoIpBPn64nP8MFQwn7tr9scCE2fJC8JicB:hDzzgpVFVt+fXb |
| Threatray | 3'178 similar samples on MalwareBazaar |
| TLSH | A4E4CE12BB91C476CEA2B0304FAAFFA5E2BDAD9D49510D43674827CF0D7C442962E727 |
| Reporter |  abuse_ch |
| Tags: | exe tar3 TrickBot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Delayed writing of the file
Deleting a recently created file
Launching a process
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Signature
Allocates memory in foreign processes
Contains functionality to send encrypted data to the internet
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.TrickBot
Status:
Malicious
First seen:
2020-11-19 01:49:30 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 3'168 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:tar3 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
102.164.206.129:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
103.131.156.21:449
103.131.157.102:449
103.131.157.161:449
103.146.232.5:449
103.150.68.124:449
103.156.126.232:449
103.30.85.157:449
103.52.47.20:449
Unpacked files
SH256 hash:
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3
MD5 hash:
c252603232987121f642be93e9e39348
SHA1 hash:
9a06574b7f9f732cf6265fe0aff4c133c1cb8314
SH256 hash:
1e7fd8ed2e52ebbc3faa78905b4863e2ac2ae7efa65602d6913f6fbf88e9a134
MD5 hash:
3df3b306cab2e0521b3b572087fe4c0a
SHA1 hash:
b95fe59d10f98f8a9b1b47e7e4aba803e6b576a9
SH256 hash:
5458f49b6cc29efd54a5a6dd9dc1893d62792b0cdf012937ca32e42a86f3f721
MD5 hash:
0964cbb10ad3b018582fcf53fc11e843
SHA1 hash:
3f5b131856f7619ecdc915a87fac9ed24208f07a
Detections:
win_trickbot_a4
win_trickbot_g6
win_trickbot_auto
SH256 hash:
1bc5b80cd82132d4918397f66b3123f609c301c9d5f4199cdb36c1c2800a51d9
MD5 hash:
55631beedac06dfdad748dadc2ba3d1f
SHA1 hash:
4e745e567651fbd863aed20d39ca9ffd75e01154
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.