MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
SHA3-384 hash: 3ab8cc96c8bdf05f1cff5535d0ed7c56bd9e0275ba1369a1d54e57fb2c6a17029cabe8ac79ce018ec8525c4204f3e3b5
SHA1 hash: 4608fe044c4d02ea260adb55b386f8cd1a5ea5e7
MD5 hash: 978fb9a64fb30f1fb07770c377d18a40
humanhash: comet-sweet-earth-three
File name:978fb9a64fb30f1fb07770c377d18a40.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:450'560 bytes
First seen:2021-10-09 06:39:03 UTC
Last seen:2021-10-09 07:58:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f8cb6cf7a746c79f8c917be532cea46e (8 x TrickBot)
ssdeep 6144:oxcZrtODZGn9XI1c2Ykh2JmvYvWFuQX7tPbzHhzWEI8BmNbeIM625anGD:emIDZIkRYvWMQX5z0J8INqzkGD
TLSH T11DA4D023F1F0C8F6C1A316710DB15BAE7676FC10CBB5DA9753805A2E1C7269689233A7
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe lib161 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
450
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
978fb9a64fb30f1fb07770c377d18a40.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-09 06:39:50 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8718cda3-04ac-4bc9-8176-c9db886d45ad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196270/
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.16767.28202.2196.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger packed zusy
Link:
https://www.filescan.io/uploads/61613909ddf069d1b6a4f0ba/reports/d05556df-bfeb-491c-a76c-a55632e5213b/overview
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/867374
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-09 04:39:00 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r2wd5vswmoux2tvrewbs3bv2t5xpytriw2a3mqstae6z4agwmwoq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib161 banker trojan
Link:
https://tria.ge/reports/211009-hemp6sfaf4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
69d7ed37a28c55a127c7c30e60de8c30136037c96882bc31f6738868af2128d8
MD5 hash:
86e674d08ed461c335609f49aa5c532b
SHA1 hash:
f3344e3224e9da719356a6823dd1a067625b8c77
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/829ae19b-8ceb-4293-97f8-15a248af60fd/
Parent samples :
8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
1b4868da8f522b4429246ad852b42f55299a28414e26686529d805d5426ebb4f
SH256 hash:
72bbcafef8824b6d324736c62ce15951ac546291b180017b3ebc82bcf3f1bac2
MD5 hash:
4ecc3982d91503b95135dabff700db39
SHA1 hash:
74812c6c53fce012244cd0e4a83417d5443d62f1
Link:
https://www.unpac.me/results/829ae19b-8ceb-4293-97f8-15a248af60fd/
SH256 hash:
946e3d2675f13c9b436575305db51c20a7b21110b11d44e518939135960e82c9
MD5 hash:
57f07e1e9b5257d0da0b15040a7187f3
SHA1 hash:
e98f0a909e754bd91ec06678af8b5b10467585aa
Link:
https://www.unpac.me/results/829ae19b-8ceb-4293-97f8-15a248af60fd/
SH256 hash:
8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d
MD5 hash:
978fb9a64fb30f1fb07770c377d18a40
SHA1 hash:
4608fe044c4d02ea260adb55b386f8cd1a5ea5e7
Link:
https://www.unpac.me/results/829ae19b-8ceb-4293-97f8-15a248af60fd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8eac3ed65663/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 8eac3ed65663a97d4eb125832d86ba9f6efc4e28b681b64253013d9e00d6659d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1655282/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196270/

Comments