MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6
SHA3-384 hash: 60a879db9ac193a0869dc874968efaa948ac104ec77c0ce00a7d9d20993d15a082c55a7aced89197e05e62f00defd3c5
SHA1 hash: 2d978e2767f2e3b78e4f063c5066018557b7c887
MD5 hash: 0ec4bc1867533431b3c9c6501b472262
humanhash: green-william-india-india
File name:0ec4bc1867533431b3c9c6501b472262
Download: download sample
Signature TrickBot
Create hunting rule
File size:589'312 bytes
First seen:2021-10-01 12:34:12 UTC
Last seen:2021-10-01 14:18:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4052499054ea62aacc9b71303ced775c (12 x TrickBot)
ssdeep 12288:+7UffyoMiaBpylVC/SrIA42E9VH8O1zdMNev6CP:+7UfKyS/SrV42EvcO1lvd
Threatray 2'553 similar samples on MalwareBazaar
TLSH T16CC4BF1177D0D432D2B235724B6AD674AAAEFD319F75474B27C03B3D1E30292AA3871A
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter zbetcheckin
Tags:32 exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
226
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0ec4bc1867533431b3c9c6501b472262
Verdict:
Malicious activity
Analysis date:
2021-10-01 19:42:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5e994ec3-fb84-4ec4-8ef1-9a4b128b23d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193991/
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.16690.12863.18371.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Enabling autorun with the shell\open\command registry branches
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1f5dd9a4-ca32-487e-a1e9-11c0cfb67b02
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/862709
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-01 12:35:07 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s2ltnx5xhxq5lwh5omqdmnt77rvthlx5v5krpbo4tgmperc6qdla._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
3816e3845184a41e9c7a1bcb9dacd089e712f72fff6f44ab4d55d563b0177652
TrickBot
437d0b75f67c18c12a35d9c0e1a32fc57b426834fa4df63f30f11cb17dd24528
TrickBot
473dfbecc3818114569a9a9f80b0a51ad74b3d88fa778158ab145e839ecb042c
TrickBot
5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2
TrickBot
83f374f57d674ac1abf87f968ba37237e5403bcae01ded47b7a912c4c5a58163
TrickBot
9a5d5f4144492833b2f5368bf39154e0a5d60914afccbfde1db93cf0cd9db000
TrickBot
abd7a64e1bf9248c1e53f32ea222a1e448132346edb55a3dbca55354bc3488d1
TrickBot
b88d012225e5e8af014bea93cd04c3655f9b46c77f06557a857868ceda46153a
TrickBot
c58672786cc5ff1aee1f2f582e209857a8fe055d5fefda026ff374cf7dab3968
TrickBot
d76bcc765a822ded81cf1518ab3d65e08cc42ccf946d9381d1115934abe6fed5
TrickBot
+ 2'543 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:top127 banker trojan
Link:
https://tria.ge/reports/211001-psb9xsbgh9/
Behaviour
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
18f4ce1f985e2d1c690f5cb0151ad2876fb4e28b985a265e9a47145a9e4fa896
MD5 hash:
7637f54f5e2d972dec31a61050511726
SHA1 hash:
f571b7ad392dbdd40ef690666a2fdde951860f0c
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/c48eb018-80eb-4d08-925a-51ccfcb37007/
Parent samples :
969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6
620255bf64d796af1335256a9d9314e393631ca793c1ace9f3a9b04552c42d7f
SH256 hash:
3b9426e2b36fa7e0c1420c95a9ae419c47bfb3ce3f003f1f28103d004043f951
MD5 hash:
e2c33c5f4cf9648c9d1b50bb50fb33d5
SHA1 hash:
843cedeb3fe91724d03855f52ebcbaed7c940c6e
Link:
https://www.unpac.me/results/c48eb018-80eb-4d08-925a-51ccfcb37007/
SH256 hash:
1f948c2870f782797e42af1749932aecabdd43cf9b0ea3cb247641d55ac75fb8
MD5 hash:
49b1bfe6fca95d3c4e5bc6ecb5e1f45a
SHA1 hash:
5e4c68cdecab62e8324c33f0cf835227666b784e
Link:
https://www.unpac.me/results/c48eb018-80eb-4d08-925a-51ccfcb37007/
SH256 hash:
969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6
MD5 hash:
0ec4bc1867533431b3c9c6501b472262
SHA1 hash:
2d978e2767f2e3b78e4f063c5066018557b7c887
Link:
https://www.unpac.me/results/c48eb018-80eb-4d08-925a-51ccfcb37007/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/969736dfb73d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.trickbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 969736dfb73de1d5d8fd732036367ffc6b33aefdaf551785dc9998f2445e80d6

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/193991/

Comments