MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 897f005084da429d61de951a7a1a1a6d2c64c1716c02d7615fd77cd12cf69132. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	897f005084da429d61de951a7a1a1a6d2c64c1716c02d7615fd77cd12cf69132
SHA3-384 hash:	f4e9facdb54badd5eaa3a139b03e4cc71bd0774fbd9f7ac60d4029fe16ac1b1bfdab1f23234498df96e885645903f253
SHA1 hash:	8ebca82be87f8d8f47878d85dc96f27ff38348cc
MD5 hash:	864bf717d9da22cf097a40028dce6084
humanhash:	coffee-coffee-cardinal-helium
File name:	864bf717d9da22cf097a40028dce6084.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	803'005 bytes
First seen:	2020-09-11 05:28:55 UTC
Last seen:	2020-09-11 06:43:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	93dc88155a00ae749ca86929ba8dffd0 (23 x TrickBot)
ssdeep	12288:KbQ5Gmpe+jNBNF8KegmyC+cbGxRt4tIUcOWTFLR3q69zvEQIXE:KcFjZB38KeUC+cbYRt4UB9rhYE
Threatray	2'945 similar samples on MalwareBazaar
TLSH	46059E23AD40B44ADA0B0CB15DFD5A7918363C2164156D4BB2D5BE8C2CB2AD36DF932F
Reporter	abuse_ch
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

264

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Trojan.Agent.EWFR.11436.26428.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Connection attempt

Unauthorized injection to a system process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/463819

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/897f005084da429d61de951a7a1a1a6d2c64c1716c02d7615fd77cd12cf69132/

Threat name:

Win32.Trojan.TrickbotCrypt

Status:

Malicious

First seen:

2020-09-11 05:30:08 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rf7qauee3jbj2yo6sunhugq2nuwgjqlrnqbnoyk7256nclhwseza._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

2aad79eb324a7487c9f8267967a14f593289ab615cebe5a8569fd7bd14d7504c

TrickBot

51c6e8784fe2faa618b8b7df5df29d627c8070c8c793bec66df8449f8cff1e2d

TrickBot

57d1d4ea8ba37942a6c6e2db8190d2daf105dec86c5533e7b816c4faa2891c3e

TrickBot

6d18824807eff95fa0f954a096e12956fe309244582383c9e36756e3370ed208

TrickBot

6d598b39ecf384c57da9034aacaa4b6775f644c4b51f0b907711f35aa2cd8047

TrickBot

75b2e7fc7a83b5d8c0a0613063bb85e95f0140b30351bba50a20b8c0df12292f

TrickBot

83d280fb871c5242734b43653ef247dda9f699b37b0db8864ef6de1227e825e2

TrickBot

843a9782dab6e69053e6f7bef20491fb3b6756919aa0001522d532a4368831fe

TrickBot

912790d045d0e672bfb1069b453c50e22f1ab7b5d728c364ac3c5cdd05e85c4e

TrickBot

+ 2'935 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

trojan banker family:trickbot

Link:

https://tria.ge/reports/200911-sy32l11r42/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Trickbot

Malware Config

C2 Extraction:

51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/897f005084da429d61de951a7a1a1a6d2c64c1716c02d7615fd77cd12cf69132