MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
SHA3-384 hash: 23c3f72f31dcb9b8e6fc78fabe93319b5fccc33e81bd5a50d6f2ad5efee51948344ec6b2c005847df8936de437bf873e
SHA1 hash: 3166a8b05fab2c455586e717210bdf1dad621fc1
MD5 hash: 974d669e861896a0ebd61c7f2d6e8729
humanhash: bacon-mississippi-skylark-echo
File name:b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
Download: download sample
Signature TrickBot
Create hunting rule
File size:132'096 bytes
First seen:2020-10-24 21:05:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:9Wql7iWCRq3JV0npTvzY7hEsZNhh8J3Wn:9DNiWn52k7hEsBh
Threatray 5 similar samples on MalwareBazaar
TLSH B8D3490AE7D782B1FE9601B0167EB73F997152216B159EC3C7A01C20AD512E3A33E76D
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75275/
Detection(s):
Win.Packed.Trickbot-9633235-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/508735
Signature
Antivirus / Scanner detection for submitted sample
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 22:15:09 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wahh65ctttzzsqgjarfwvqorggrdzclmpec5ogqipiasiursvwrq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
TrickBot
e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
TrickBot
e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
TrickBot
fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/201024-d5tjkkynyj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Trickbot
Malware Config
C2 Extraction:
131.153.22.145:443
62.108.35.29:443
45.89.127.118:443
185.99.2.123:443
62.108.35.36:443
45.89.127.119:443
51.77.112.255:443
194.5.249.216:443
185.99.2.160:443
80.85.156.116:443
86.104.194.102:443
37.220.6.115:443
Unpacked files
SH256 hash:
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
MD5 hash:
974d669e861896a0ebd61c7f2d6e8729
SHA1 hash:
3166a8b05fab2c455586e717210bdf1dad621fc1
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/511fb108-4a75-4f7e-93b2-6255175aee3e/
Parent samples :
e02ce2fd3f6b85b8375e889bfdbbe2684c8855260f24a46880169a629b373bc4
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75275/

Comments