MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a67c82a1a2170e3e7c047133489867f844674009720628058aa7d9299b2b89ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a67c82a1a2170e3e7c047133489867f844674009720628058aa7d9299b2b89ab
SHA3-384 hash: fb9a7b0ddd6fdfcf0fcfdc0075948eefcc38e288050dbdb50ed1d436d973cc6d04d375acbf1a0b63227bbcf41b31beb6
SHA1 hash: d4a814c4130ecec9410ed8e3c04b37588c384be6
MD5 hash: fd93a46bff846eec4fce4a965b7056dc
humanhash: london-lake-diet-freddie
File name:samp.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:133'632 bytes
First seen:2021-05-30 13:01:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:Nko1o9B2yEDTo0wK9qQNx0j467CQEx9f:NkoaIDTKjIx0k6GQK9f
Threatray 12 similar samples on MalwareBazaar
TLSH 95D34B0DE6E3D2B5EF8500B1272EB37F5D615221AB1699C3C7D01C24A9512F3A33E7A9
Reporter Anonymous
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
459
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
samp.exe
Verdict:
Malicious activity
Analysis date:
2021-05-30 13:02:30 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/9050d4e0-7ec1-4795-8f1e-eee77c3c0687

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/163266/
Detection(s):
Win.Trojan.Trickbot-9833091-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
DNS request
Launching a process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6f6d93be-37b5-4a09-9df9-e4c665ae1244
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/794370
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a67c82a1a2170e3e7c047133489867f844674009720628058aa7d9299b2b89ab/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-05-29 04:50:36 UTC
File Type:
PE (Exe)
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uz6ifincc4hd47aeoezurgdh7bcgoqajoidcqbmku7mstgzlrgvq._file
Verdict:
malicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
003af0a8411a8f280a4af0c3ab807b0572a7dbbc782c4f007fcb7889bd683e9e
TrickBot
4f9ee40b7d76b088cefa490c13237ad5bcfac195dbbac32d5f14d002189fa2c9
TrickBot
7974d6324dbba7811d9a59dd5784751536a35689a50609e2739ba3370c70aa43
TrickBot
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
TrickBot
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
TrickBot
d314ff883243444f1853614759a5ec7af96a1829cebdeaa283fc1051e4261ffa
TrickBot
e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
TrickBot
e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
TrickBot
fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
TrickBot
+ 2 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob87
Link:
https://tria.ge/reports/210530-2xdybbab1x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Malware Config
C2 Extraction:
196.43.106.38:443
186.97.172.178:443
37.228.70.134:443
144.48.139.206:443
190.110.179.139:443
172.105.15.152:443
177.67.137.111:443
27.72.107.215:443
186.66.15.10:443
189.206.78.155:443
202.131.227.229:443
185.9.187.10:443
196.41.57.46:443
212.200.25.118:443
197.254.14.238:443
45.229.71.211:443
181.167.217.53:443
181.129.116.58:443
185.189.55.207:443
172.104.241.29:443
14.241.244.60:443
144.48.138.213:443
202.138.242.7:443
202.166.196.111:443
36.94.100.202:443
187.19.167.233:443
181.129.242.202:443
36.94.27.124:443
43.245.216.116:443
186.225.63.18:443
41.77.134.250:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/a67c82a1a2170e3e7c047133489867f844674009720628058aa7d9299b2b89ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:TrickBot
Create hunting rule
Author:sysopfb & kevoreilly
Description:TrickBot Payload
Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/163266/

Comments