MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3
SHA3-384 hash: 92b6093675d9e9dd8a6eebb8a13245d8a5549ed598303c8006c81965923bcdcc23b781edf091992d9b5a501676f7ec50
SHA1 hash: fa11a7585f5255447e6b3f5dfc2d78d6d6a22605
MD5 hash: 3bd37a0d6936e911850beb6d22f06b19
humanhash: lake-uranus-shade-pasta
File name:3bd37a0d6936e911850beb6d22f06b19.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:364'544 bytes
First seen:2021-09-24 08:46:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4d85858bad44ef6cace325b0f2f52ab8 (11 x TrickBot)
ssdeep 6144:eYvQ/znmUG0tkCxN08w6cVpsyAAtTaOM6hA6gWJSn0xpCpdB5:TQdt3xN08w6cpt2ZH6S0xpI
Threatray 1'032 similar samples on MalwareBazaar
TLSH T1D474F10236D488BAE1E257320EBA57A8E7AAFC704B73C55F2B541A0DC8356918F35773
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3bd37a0d6936e911850beb6d22f06b19.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-24 08:58:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/52cf18a5-f0f5-4ef7-995c-e63dd3508291

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/191125/
Detection(s):
SecuriteInfo.com.Variant.Zusy.401810.16282.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ec8020ea-ff7c-41ae-ac63-c6ebd075d4ef
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/857211
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-09-24 08:47:12 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tvm62k56oggtldno52mtaus5qnpg3ebqmxj4skb3mtaetmcclljq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
135dfd26acc2ab044b4159e7e0da289e2c7835c4049100106a00ca7d232bddea
TrickBot
2065606bca8d275526d8497a7e2fe49ed6cefb6c050aae19841bab643e45baf6
TrickBot
5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0
TrickBot
83f374f57d674ac1abf87f968ba37237e5403bcae01ded47b7a912c4c5a58163
TrickBot
944c18692e200c4de70817facee4fd8662c99743d64e57e43dd3f212d68e8003
TrickBot
a3169da61f96b181fc44fd514040fce58c1cc54dd9fb31da42fc2a98db0de7a6
TrickBot
bdce492e4d57278c61292d96fc20f8de5d9649cc2acc243b89243204d183be1f
TrickBot
fd26c012af2d0325a5eb2397fa3b6b36b8480dc99a6f7b81b8a6423b029ca03b
TrickBot
fdbbfcaac090ccd1b7ce3289ea862e5c8f0ced4318f368db0e6976df950e9706
TrickBot
ffaa54fe26b7cb4b86bdb7d49a5b2e609cffdc3c3db9460a77f074b503988504
TrickBot
+ 1'022 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lip124 banker suricata trojan
Link:
https://tria.ge/reports/210924-kpw3psgddp/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
5fd416f005dde1c4a67450cbd37c7c0977682d2de6e9853acc3cce53138cb1bf
MD5 hash:
f94bbb90aa985ac4027fcfafb5314902
SHA1 hash:
cf2deef61c1d2d8797822a69481e0d77e2bb2c6b
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dea34b1e-07dc-4d1a-914b-ba23ba00fff7/
Parent samples :
a3169da61f96b181fc44fd514040fce58c1cc54dd9fb31da42fc2a98db0de7a6
9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3
d825da453d80559eabf1d90dc46af91ce1a05448b4583d963e6fd3d05f87f208
SH256 hash:
9b1e17528a079eba9f69df87aeb0c27315de915b30a47240b6716d53d4ffd477
MD5 hash:
d284f58f7cbea90bd54bb8942d40c61e
SHA1 hash:
5d15a00de99343e67c3a71b06d08dd1890189e3c
Link:
https://www.unpac.me/results/dea34b1e-07dc-4d1a-914b-ba23ba00fff7/
SH256 hash:
2cc1fb46be856d77f3e09077b04a7aacdc56f4d662888e4a404977249ef7bd45
MD5 hash:
c2962f91e957e8db4226dde8d013a9e8
SHA1 hash:
796a3b09cd82c577e25c86c79c2ad7ec08ab124b
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dea34b1e-07dc-4d1a-914b-ba23ba00fff7/
SH256 hash:
9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3
MD5 hash:
3bd37a0d6936e911850beb6d22f06b19
SHA1 hash:
fa11a7585f5255447e6b3f5dfc2d78d6d6a22605
Link:
https://www.unpac.me/results/dea34b1e-07dc-4d1a-914b-ba23ba00fff7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9d59ed2bbe71/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 9d59ed2bbe718d358daeee9930525d835e6d903065d3c9283b64c049b0425ad3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1641955/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/191125/

Comments