MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a1fc2de129a140468451b41f79bd76f056f790550a500909f67cf009419a717. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a1fc2de129a140468451b41f79bd76f056f790550a500909f67cf009419a717
SHA3-384 hash: c254640ff8657ea276704d97b130528010a8acfda658fdfd16147a69ae68be4577bead45c0192f0ecbf9cda48f1bf595
SHA1 hash: 66d5621da53919f64054890670ccd0b6d93de8d7
MD5 hash: 84d8fd2f23ee339115c6a26514818d11
humanhash: alabama-oklahoma-kitten-artist
File name:update2.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:615'936 bytes
First seen:2020-07-06 15:23:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a2b6c6469796e30e5f7974810e8ee53b (3 x TrickBot)
ssdeep 12288:KEzVSrkS8aSDS18Nbdi854ta327u7/PRnJ:KEzVSb8jDS18NbdiXtarf
Threatray 5'042 similar samples on MalwareBazaar
TLSH D3D4D02173C0C073C29224B64A9AD7B54A7BF4711B612ACBB7DC4AB95F647C19B3234B
Reporter abuse_ch
Tags:exe TrickBot


Avatar
abuse_ch
Malspam distributing TrickBot:

HELO: jax4mhob19.registeredsite.com
Sending IP: 64.69.218.107
From: Mail@herronengineering.com
Subject: Lucas Wood from Keen Phillips
Attachment: Items_Pricerate20200335.xls

TrickBot payload URL:
http://144.91.79.6/rbuHBJ049s.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21718/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Delayed writing of the file
Deleting a recently created file
Launching a process
Launching a service
Sending a custom TCP request
Connection attempt
Unauthorized injection to a system process
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9a1fc2de129a140468451b41f79bd76f056f790550a500909f67cf009419a717/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-06 15:25:05 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
01aa55a89b1daf73919d9e2e8d4570be3a1f5df44d9b085d097b75a153e93a56
TrickBot
0d94462f293a6a366797348ae505498819f598a7e406678d904064a0a4849f98
TrickBot
10a0cdd0253d5747a6d4c5f409247c893a2d67a6e7624008dbc42fca3b3fc789
TrickBot
254276c73f2d96f4aab8a96a326b222a05c4e72568e18455469915fb992ec184
TrickBot
3346b8335a4cf275625e542dff2f3e2b9a9f7748cec2ceb80cfb0ab7789fc0d0
TrickBot
55109a2a108c6539ef4528f9b5fe35ccfae40f86c9595f9b47e923e532d7331f
TrickBot
583e2b0cb3e97254796a4e4bd6887e4e971dfc8e97c009a6cff84444d01fb237
TrickBot
734b259f20b4989df93555fde599b5ea9375a7c10f9e6abadb856bfe54343ec1
TrickBot
de17b595043198f000f56225c386a2177d7d6a5decd42b08f5bf6938751131b2
TrickBot
e6d0cd4425a0d27fa8b175b4545a77a5b543dbe21d0ff28a948f75b0519fafa0
TrickBot
+ 5'032 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200706-z2xtkzvg4e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Malware Config
C2 Extraction:
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Excel file xls 587297cadc5ae9c0b834017d49e342b04a9e6978a7a5848439ddd338c1f1d88f

TrickBot

Executable exe 9a1fc2de129a140468451b41f79bd76f056f790550a500909f67cf009419a717

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/408281/
  
Dropped by
MD5 75396e11d6cc96000d39ec1d3018d034
  
Dropped by
SHA256 587297cadc5ae9c0b834017d49e342b04a9e6978a7a5848439ddd338c1f1d88f
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/21718/

Comments