MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
SHA3-384 hash: 8236725f3f2c13ccd900326195126d02e4991d21cac88ee475c545cffd9334f9a187157366a1e76d0524dff1dfebaac1
SHA1 hash: c7093ee0bee24393dddfd45cd4758fdbe2cbb3a0
MD5 hash: 6b3106498b7a96f2c81226e9f8b641db
humanhash: muppet-victor-comet-four
File name:6b3106498b7a96f2c81226e9f8b641db.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:647'168 bytes
First seen:2021-10-07 08:48:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 96459f3ac5474c1f5d7b0f19d0d0d7ca (4 x TrickBot)
ssdeep 12288:f+t405GC8+pDumfo7RBBun3vDNopBzZ3a:eB5GC8+pDsbBMvB4BFa
Threatray 2'249 similar samples on MalwareBazaar
TLSH T19DD4C012BBD08876C99322324AE3A735A7FDEC015B22C7CB57D46E1EAC726C54D36316
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
234
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6b3106498b7a96f2c81226e9f8b641db.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-07 08:58:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5b8d3c1a-fdb1-4132-b867-92ed5b9db5c0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195711/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/615eb481e3d213d202b99dad/reports/c546afb6-5358-4f20-8d87-19fee7588c67/overview
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/866171
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 08:49:05 UTC
AV detection:
17 of 45 (37.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tamq3lxw7k7ake2rrfb77pe2xsxu3v6ax7jxxsmw7o7cmhmddm6a._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
37c129eb8bb575d7ac12fdd14b5d05edee15c1230d7b712e5b9d2533f78dc5b4
TrickBot
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
TrickBot
944c18692e200c4de70817facee4fd8662c99743d64e57e43dd3f212d68e8003
TrickBot
be73990affb5a559127094b6869889e821b872eeb774940af74b44ee3b503054
TrickBot
cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415
TrickBot
d76bcc765a822ded81cf1518ab3d65e08cc42ccf946d9381d1115934abe6fed5
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
+ 2'239 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib159 banker trojan
Link:
https://tria.ge/reports/211007-kq2dtacag2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
23552087f88bd9eaf2910a5ff75e63fc6b23b19ccd79c457b5065a3876f654a3
MD5 hash:
1fc9efed511a8f773868a03b7cc19154
SHA1 hash:
1a7eccbddcaec7d67b358ea586757a8f3a579906
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8572ab66-e716-4dec-aea7-6a0dce5dcefd/
Parent samples :
474fcb16f50018e645e155ca03a096d2b8af685e528de42e1c3eadb7a020dde1
5e246d1722c944c3942739a0502fd70e192a29fe20dcbe90a46b69c4f40c4e67
49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836
1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54
SH256 hash:
f309de23aace3fd21e9fd5f8bdcfdc748a579d3650434fa2690c0ddabd30ca83
MD5 hash:
bed037f289498ca10e96c442a97ed098
SHA1 hash:
00e15644a2c08a05318542b5f66017b976cb5d0b
Link:
https://www.unpac.me/results/8572ab66-e716-4dec-aea7-6a0dce5dcefd/
SH256 hash:
d9be4d8eeec4c223359138df7a2fb0c182a33bc9f9ba6b66170b25766d05bb99
MD5 hash:
6fad2d826ffe2e5337e0146edbffc8fc
SHA1 hash:
19c12ad56aa50acced7a733e7e7d6dd20e94f39b
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8572ab66-e716-4dec-aea7-6a0dce5dcefd/
SH256 hash:
98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c
MD5 hash:
6b3106498b7a96f2c81226e9f8b641db
SHA1 hash:
c7093ee0bee24393dddfd45cd4758fdbe2cbb3a0
Link:
https://www.unpac.me/results/8572ab66-e716-4dec-aea7-6a0dce5dcefd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/98190daef6fa/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.trickbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1655282/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195711/

Comments