MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8
SHA3-384 hash: f330c96303db51836a4eae0604e7402432a0c957b95441b0691d5e7e1e63f5c9c376a93affd1eddb58008ac3225867a6
SHA1 hash: d4bc3c29b9f1dbd0a7876fb06e36207f963ade31
MD5 hash: 16a6e8ecf60f1800e8a0d779024eb588
humanhash: enemy-spaghetti-nine-grey
File name:16a6e8ecf60f1800e8a0d779024eb588
Download: download sample
Signature TrickBot
Create hunting rule
File size:656'896 bytes
First seen:2021-11-05 21:34:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2a49715e49b2891839bf716e121ca434 (12 x TrickBot)
ssdeep 12288:5nZndx1krxFPqBSPl7bQ9k03GxGprGwbKM:9ZdxuQSPl72k034GJGf
TLSH T191D4E0213290C032D1A324718E66DBB98E7EB861775265CF3BD90E7D4F24BD1EA3531A
File icon (PE):PE icon
dhash icon 0000000000000000 (872 x AgentTesla, 496 x Formbook, 296 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/202835/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/6185a3898eec38053680530c/reports/7795cd57-5722-498b-9375-a8786e1c9082/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9f377539-9008-4b62-97e4-0ed70618fa30
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8/
Threat name:
Win32.Malware.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-11-05 21:35:09 UTC
AV detection:
6 of 44 (13.64%)
Threat level:
  2/5
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib176 banker trojan
Link:
https://tria.ge/reports/211105-1fbneaaagj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
552e2738471d81cc064a26d533e0bda7abb645471fcc5e38368881e437a2d6ce
MD5 hash:
02d583dffcaea4888dae2571bf5b1445
SHA1 hash:
d1501b44c78623596dd18dbf8607e469effa30cc
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8fe08c09-f6e6-4eed-9404-0cb39e2b548c/
Parent samples :
96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8
fd2ca05f1fb05028f501bce46ebb5e5131845b8f9e7c710fa527ed5ac0c15bc8
3d775f1f2da385ed73d988930d9c9675fc2e466098bb5f19c8501a723e14f437
SH256 hash:
96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8
MD5 hash:
16a6e8ecf60f1800e8a0d779024eb588
SHA1 hash:
d4bc3c29b9f1dbd0a7876fb06e36207f963ade31
Link:
https://www.unpac.me/results/8fe08c09-f6e6-4eed-9404-0cb39e2b548c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/96279095f406/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 96279095f406abd224f8cd7bd306177841bd04099e5a1bb53939d0befd83ffb8

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/202835/

Comments