MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d
SHA3-384 hash: 6fb7d8b03f83a757bda106702497020cf17b86caa0f0bf40a4d1d4436cf076aa4aee11dfbb600254804b272e0e86221f
SHA1 hash: 420d1ee8dd72fa0c0196a65b631e5bd690078882
MD5 hash: 0686d0c6289fe85b513173479a4b6cf3
humanhash: whiskey-bakerloo-mango-spring
File name:0686d0c6289fe85b513173479a4b6cf3.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:656'384 bytes
First seen:2021-11-08 19:25:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2a49715e49b2891839bf716e121ca434 (12 x TrickBot)
ssdeep 12288:InZndx1krxFPqBSPHLQuDACflBMhhDKG/M:AZdxuQSPsu8Qm5J
Threatray 4'174 similar samples on MalwareBazaar
TLSH T169D4E0103390C032D5A324718A69DBB58E7EB861676275CF3BD91E7E5F24AD1EA3430E
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/203369/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/618979d0dec33478259fd60e/reports/f29b4d1f-15e1-4e85-9f27-6974b204966f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21d23182-9aed-4c9e-8e08-07194680ea50
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/885520
Signature
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-11-08 19:00:18 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sl4gdfjyzkab7gxxr6wpzxmn6on7gvnr4xio3vv45gqpvhdexcoq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941
TrickBot
061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565
TrickBot
074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e
TrickBot
d418e24f1da80e970160a4192050392dbf3e50a89458f46dbbd753423ebdbbde
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
+ 4'164 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot176 banker trojan
Link:
https://tria.ge/reports/211108-x5h71adaa7/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
9335d48fdc4d8f658194291028c32450f823fdc0521bf6e823bb0e7882c5b0b7
MD5 hash:
0f9de9501b0d3f28fed2cd9734296642
SHA1 hash:
92f3ad27a41774ae916f5cc742ef70f6598e5b6f
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d6358ca6-3cc5-43e8-bb8a-ae3be20a3a8e/
Parent samples :
22fb786d79039626d478c88e16ad8da6fd1525a2dfae6f8e2510b0522c063377
06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9
92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d
SH256 hash:
92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d
MD5 hash:
0686d0c6289fe85b513173479a4b6cf3
SHA1 hash:
420d1ee8dd72fa0c0196a65b631e5bd690078882
Link:
https://www.unpac.me/results/d6358ca6-3cc5-43e8-bb8a-ae3be20a3a8e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/92f8619538ca/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 92f8619538ca801f9af78facfcdd8df39bf355b1e5d0edd6bce9a0fa9c64b89d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1755435/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/203369/

Comments