MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79a0a45da3fe5cf0389f99ab865d4c83d103617df6c54dee4e82ca6d79c69792. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	79a0a45da3fe5cf0389f99ab865d4c83d103617df6c54dee4e82ca6d79c69792
SHA3-384 hash:	01d3b182fa1551639964325ed614a1d7b9b5a52f4acad8d6d834a71ce66e90a0e1f54ef729aacca0480e0cd610ddbb3b
SHA1 hash:	f53f5912106371f58e351fd65cc4ffe8d0a5c1ba
MD5 hash:	65c9ad9fb6f6c221b31d0def80915b8c
humanhash:	speaker-maine-hot-speaker
File name:	65c9ad9fb6f6c221b31d0def80915b8c.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	491'577 bytes
First seen:	2020-06-29 07:17:14 UTC
Last seen:	2020-06-29 07:44:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b7b8868231f0e673930dc8f90c57a8c6 (2 x TrickBot)
ssdeep	3072:uGkSY8xWFdFE/fS8sY6PguLVJfI8h6tXKBE/fzgmP3uZ3qGNRpAS9iHJz7v9UNeQ:UMxWFdFY6IiVRBhoRzg0Z6AZbts1b
Threatray	6 similar samples on MalwareBazaar
TLSH	2CA4C033F94CA545E52301B209355A781E3B2C3714365E8BA28DED491B73A53BDB272F
Reporter	abuse_ch
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

TrickBot

Link:

https://www.capesandbox.com/analysis/15518/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader33.58091.20904.31346.UNOFFICIAL

SecuriteInfo.com.Trojan.DownLoader33.58091.22794.13515.UNOFFICIAL

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/79a0a45da3fe5cf0389f99ab865d4c83d103617df6c54dee4e82ca6d79c69792/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-06-29 07:19:04 UTC

AV detection:

24 of 27 (88.89%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pgqkixnd7zopaoe7tgvymxkmqpiqgyl563cu33soqlfg26ogs6ja._file

Verdict:

malicious

TrickBot

2e5d88bc0b089338cd5608b1b0766efeae2f0f8cac9c573793a99b627441ff85

TrickBot

3ab5b0ccf5b8a334be2056a5b257ca676f3afe333965a8a70b3b562b51e50f03

TrickBot

73a0eff4b25b824af4b6600db0f637f991b45b0945c9385fd6e7eca289b7e5ed

TrickBot

c16e569fe7d77436566b268fab7037ab71efb99a5108aa452602479267508305

TrickBot

d00c3b92cbed81d0a68b1c123efceceb812351caafa30dc1253dfd5b8b20a937

TrickBot

Result

Malware family:

trickbot

Score:

10/10

Tags:

trojan banker family:trickbot

Link:

https://tria.ge/reports/200629-vxdvhyrkya/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Trickbot

Malware Config

C2 Extraction:

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Please note that we are no longer able to provide a coverage score for Virus Total.