MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c7f5cb3a4abac7fd494817a20e4c8d52d6fa4951fa864836e8d3cdcbbff4841. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c7f5cb3a4abac7fd494817a20e4c8d52d6fa4951fa864836e8d3cdcbbff4841
SHA3-384 hash: e4bcd48ba6f2882cc7ec520b6c1d38344015f3ff740a2dfe76ce58651c2e850bae2288da34dd7c1ce8a3e7780852cd60
SHA1 hash: 594eba4bc96abdd3e9e89aad3ffbabd8246d44fd
MD5 hash: d89c20f772efe4cc800d4b00ce386a52
humanhash: december-illinois-cat-foxtrot
File name:7c7f5cb3a4abac7fd494817a20e4c8d52d6fa4951fa864836e8d3cdcbbff4841
Download: download sample
Signature TrickBot
Create hunting rule
File size:386'048 bytes
First seen:2020-11-10 11:08:43 UTC
Last seen:2024-07-24 16:37:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d2e33fedfb3988327dae4de4fd297ea5 (3 x TrickBot)
ssdeep 6144:eRqJi6KgosRlXiPkgwnFfdGM3yevbsznJ92:ev6celSPWFP3ybn
Threatray 9 similar samples on MalwareBazaar
TLSH 89844A93163CACA3DCF43BBFC7D3B5081A56659A6738686DB07D9F09B303364525E282
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file in the system32 subdirectories
Deleting a recently created file
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Unauthorized injection to a system process
Connection attempt to an infection source
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c7f5cb3a4abac7fd494817a20e4c8d52d6fa4951fa864836e8d3cdcbbff4841/
Threat name:
Win32.Trojan.Trickster
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 11:10:43 UTC
File Type:
PE (Exe)
Extracted files:
13
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pr7vzm5evowh7veuqf5cbzgi2uww7jevd6ugja3oru6nzo77jbaq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
052264ad79e29dba2e4574f24d90fc15065de02685f4fc4a308c11e972bf72c1
TrickBot
23df6c7581b2fe80336763ab3f25db6fdd1c6249b01f75beb58793628eb0c615
TrickBot
7194aa3ef48725220516bc618aec8ab92ddef859de8f584a6a214ed9812e221a
TrickBot
b18158f4b0b344bc4a14d29a5fd2a3e21ec1d6d90adf84fae18c972871a99557
TrickBot
e33efffc8425fb12d4d9f8c18a066d7f80d328cf7a74a235acf175d587146e9c
TrickBot
e9b68e43d01d092285e1d109241939a85473ec285448074d0ad0098bc1975550
TrickBot
ea6a9b346baf1452cb2353f5c00c85b1a613652b9628d96e76cd1751ddec8295
TrickBot
ee22d1b889f577512fc9a45da2ce24a1ddcafdf1fd412f8dd42aa3b112d1fa91
TrickBot
eec13ba57b49bac069e70ccd6922df9e5ea34f9e9787aa686e6bf327a10dcf8b
TrickBot
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201110-hdkyj6w94s/
Behaviour
Modifies data under HKEY_USERS
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Looks up external IP address via web service
Deletes itself
Executes dropped EXE
Unpacked files
SH256 hash:
152e046ae535d98c1f821ac4cac86dd55cc305e28d8393d125920846e542e283
MD5 hash:
5507cbd83ed356b9c5e343d43c257114
SHA1 hash:
6c4e340132362f0dc234d18206e04e1951066799
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dfec7671-ad7e-4193-9be1-ec416536c852/
SH256 hash:
4c595f402565d68badd9880040ad800ffd88bd2c3347ef061e1141d90813b878
MD5 hash:
b601502340c1c198bc1ca7207e351690
SHA1 hash:
4eaecd2d9012b14dfca48ea7c13824ce5845fda0
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g3
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dfec7671-ad7e-4193-9be1-ec416536c852/
Parent samples :
7c7f5cb3a4abac7fd494817a20e4c8d52d6fa4951fa864836e8d3cdcbbff4841
984edc19e8360156fc45d04a3ac3c1fb84b5967b449516ffa65be58c5bcee07d
SH256 hash:
7c7f5cb3a4abac7fd494817a20e4c8d52d6fa4951fa864836e8d3cdcbbff4841
MD5 hash:
d89c20f772efe4cc800d4b00ce386a52
SHA1 hash:
594eba4bc96abdd3e9e89aad3ffbabd8246d44fd
Link:
https://www.unpac.me/results/dfec7671-ad7e-4193-9be1-ec416536c852/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALW_trickbot_bankBot
Create hunting rule
Author:Marc Salinas @Bondey_m
Description:Detects Trickbot Banking Trojan
Rule name:TrickBot
Create hunting rule
Author:sysopfb & kevoreilly
Description:TrickBot Payload
Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments