MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
SHA3-384 hash: ac59ce09586b05c9e5b442bc646b11960bcc1482404a157ee0195655d10e3c6b35be104f4c7cc43a61e16f3be1f706dd
SHA1 hash: eb4bb017b2d14017f44ea32c01c54871215ea09a
MD5 hash: 59ea5e429638fa0801683014a19f10ac
humanhash: finch-speaker-pennsylvania-mexico
File name:shiybnyrsolu.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:544'768 bytes
First seen:2020-12-28 18:55:21 UTC
Last seen:2020-12-29 17:02:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b8efe40fc3d800eedc81568c1eb38c5 (1 x TrickBot)
ssdeep 6144:qb3D7lGY7+DxcNywn1RNUFCApar3ze+S5iM89fLLE/ZChnCK6gv:mvlGTxAnR9zQ8dLE/whnCK6gv
Threatray 2'921 similar samples on MalwareBazaar
TLSH FDC4BE229B446215E8934131982676F82E263C36D655AD0BA345FE283CB0ED7FDF631F
Reporter malware_traffic
Tags:exe mor5 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
403
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
shiybnyrsolu.exe
Verdict:
Malicious activity
Analysis date:
2020-12-28 18:56:40 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/0f367dd9-9991-4070-9a60-a44d7a707809

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/109611/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.72221.12494.25492.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Deleting a recently created file
Launching a process
Sending a UDP request
Connection attempt
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/570970
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-12-28 18:56:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
emotet
Create hunting rule
trickbot
Create hunting rule
Similar samples:
2f84b8a85106e702ca8a3b71db94b1dc8dda5173e9e7b1f672b28c07d37f57ed
TrickBot
34873d81dc7a0468d941294a1c62f9bb9e110d0f333f55de2da41ac6ead400d7
TrickBot
3b26296dff941f7057872a48fb9856c7533f939e75eb84bedcdbccf7e9e2ffc8
TrickBot
4ee11bd54d2f1dc61467de3f71bb6b9f01bfdd35df8fe586fa556f2383c96b21
TrickBot
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
TrickBot
58c4bea082b2f44f0beab5356ae2bc9bc73c3f13ab0491861bc2ba24690da103
TrickBot
648d3b8639ff54b8741ec84898b213836594539de6f0c11a6c9f34dccf5e79fe
TrickBot
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
TrickBot
ea5c72bce7e028a6b2f9febd90751bf0e323da00b4b0d68be2a52ed21fe2a4d0
TrickBot
f9f065cfe7edfa8c365bf45a46fd73081af15a53b9e67fb8a76f6060b142b7dd
TrickBot
+ 2'911 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mor5 banker trojan
Link:
https://tria.ge/reports/201228-fmwh744fae/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
103.87.25.220:443
103.98.129.222:449
41.243.29.182:449
103.87.25.220:449
196.45.140.146:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
Unpacked files
SH256 hash:
89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
MD5 hash:
59ea5e429638fa0801683014a19f10ac
SHA1 hash:
eb4bb017b2d14017f44ea32c01c54871215ea09a
Link:
https://www.unpac.me/results/bb1d48e2-932b-4ad7-affb-ab52348447bc/
SH256 hash:
ddf2413bc5c2ebea30d303ea614159f4a85b7ac33209c2bec227ddd274c26b2e
MD5 hash:
06db75ddfa69ed230a36cd5002c2e7c4
SHA1 hash:
2227e2d78a27ac892b1ec596d982175b436f4924
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/bb1d48e2-932b-4ad7-affb-ab52348447bc/
SH256 hash:
ff2edff71f269b2d12c68f23c6aa3e3fcd3065b90b8672f67e0c15657529cc8a
MD5 hash:
3e30ac09aec800f1c6456d352d47a66d
SHA1 hash:
a893ef5164d4b05b812cef137fad145c75cbc95a
Link:
https://www.unpac.me/results/bb1d48e2-932b-4ad7-affb-ab52348447bc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/109611/

Comments