MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
SHA3-384 hash: 3bfc2db72c215719812f1de8859b36847b3af7f198f60331f2a4a636428c680d1203a41593eb9a745dbcab12e2c61e23
SHA1 hash: 6dc29349489d216f767b4a11cab7811a13c26572
MD5 hash: e21f86a0329f9fca7eb0492f22d76125
humanhash: artist-mockingbird-orange-social
File name:7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
Download: download sample
Signature TrickBot
Create hunting rule
File size:614'400 bytes
First seen:2020-11-11 11:32:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8d30e57c6a35a6f8994c5967f3d6d712 (4 x TrickBot)
ssdeep 12288:kJBfWwcRr/Sj2SyKZpWygb2xglS/ORfEGT9cpPFTj:aayzxglSVy2pPFTj
TLSH D7D46C135DAD65E0E15205305E3A5F65283BBC263850EA4BD7A0BD6CE873783E8B532F
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Connection attempt
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/532475
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 11:36:46 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pqsizczcejrdonud6hn7gxsm5yihftz432jwihogea3uc3qegqba._file
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib7 banker trojan
Link:
https://tria.ge/reports/201111-fvsefvyrkx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Loads dropped DLL
Executes dropped EXE
Trickbot
Malware Config
C2 Extraction:
202.136.89.226:449
202.169.244.252:449
203.176.135.38:449
212.3.104.50:449
41.203.215.122:449
41.41.179.239:449
43.239.152.240:449
43.242.141.59:449
43.245.216.190:449
43.255.113.180:449
45.230.8.34:449
45.233.25.6:449
78.138.128.20:449
49.156.41.74:449
Unpacked files
SH256 hash:
7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
MD5 hash:
e21f86a0329f9fca7eb0492f22d76125
SHA1 hash:
6dc29349489d216f767b4a11cab7811a13c26572
Link:
https://www.unpac.me/results/f3da90a1-f04f-4027-aefe-f1f9d03568af/
SH256 hash:
1c6425ef65821a7f0e6fb6e235c67048718cfea69d75eb61c530b0d2f7490d2c
MD5 hash:
3a32004e2027c0ddfc7fcad87a70cc70
SHA1 hash:
d1f66cb83f3b121afc1a8e1cd4d9fca26ec650ed
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f3da90a1-f04f-4027-aefe-f1f9d03568af/
SH256 hash:
e4ffade6a267935b4f699cbe9de7b4d716edb735f3fd52434dc7c62c0aa570ff
MD5 hash:
949ffd4f39b63905165149fdfbc2a855
SHA1 hash:
1269c4afeaa03297558e3e793a624885eff46daa
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f3da90a1-f04f-4027-aefe-f1f9d03568af/
Parent samples :
7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments