MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a1ea67d9de849ae3c89926eb7f83e6fc4a5ebfefde3586caf504b29fc0d367f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 13
| SHA256 hash: | a1ea67d9de849ae3c89926eb7f83e6fc4a5ebfefde3586caf504b29fc0d367f8 |
|---|---|
| SHA3-384 hash: | 5c06fb4b40b994e1ea2dc4cbc735c469ac95fd060e5035300be307b6f73feaf02e9bd24f01c31af3a6ae4d807effb8d5 |
| SHA1 hash: | 0b757ce59003c62b39090b5a9ad13eefb0efb9a2 |
| MD5 hash: | 9ac8aaaf380bf471480359a63e48d4ba |
| humanhash: | summer-lion-twenty-friend |
| File name: | 9ac8aaaf380bf471480359a63e48d4ba.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 888'832 bytes |
| First seen: | 2021-10-17 07:22:30 UTC |
| Last seen: | 2021-10-17 08:18:45 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d3d730d77f19513c17bee56cad3fbfd5 (7 x TrickBot) |
| ssdeep | 12288:0cfkUmruxF02xWt5bSoV/XHx8B8a4TrTEChqNi9rkp/:KI02x+LXHqB8aErPqCy |
| TLSH | T1C215BF1A3AF0C476C1A355700FF27B6AB6F9ED605B778AC753804A4D6D31DC14A3A23A |
| File icon (PE): |  |
| dhash icon | 60f0f0b0e8b270d4 (7 x TrickBot) |
| Reporter |  abuse_ch |
| Tags: | exe lib166 TrickBot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
561
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9ac8aaaf380bf471480359a63e48d4ba.exe
Verdict:
Malicious activity
Analysis date:
2021-10-17 07:29:04 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Verdict:
Malicious
Result
Threat name:
TrickBot
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.Trickpak
Status:
Malicious
First seen:
2021-10-17 07:23:07 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
trickbot
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:lib166 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
04d9755c3690d4b65d990cdf4a949516e57a771bec130e765daa6e74f2083d61
MD5 hash:
b3db4abd9d025f37bbfabc3e77e1ea00
SHA1 hash:
667902d22e2e1114baa70f1abbb387b5d8bfffef
Detections:
win_trickbot_g6
win_trickbot_auto
SH256 hash:
669baf474f7e8e265f40be3dcecf687e2bed8c3bab8b70433979276b6732ad9b
MD5 hash:
1418c85574199ecd07f2a52289683cef
SHA1 hash:
401fd344e1e17331429bca54a43d02046afa7a1d
SH256 hash:
ea697216c91bf50d1f2f4f23c7f0483dafb7210e2727c361ebd9d8e9bb20bbc8
MD5 hash:
2bcc9c6804f0782da29cf2523738a835
SHA1 hash:
b8d402b1c6acdb8be3dcac82666c2530880fb57d
SH256 hash:
a1ea67d9de849ae3c89926eb7f83e6fc4a5ebfefde3586caf504b29fc0d367f8
MD5 hash:
9ac8aaaf380bf471480359a63e48d4ba
SHA1 hash:
0b757ce59003c62b39090b5a9ad13eefb0efb9a2
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.