MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0
SHA3-384 hash: fc82d852d55b0dc1e4fdebedc7a7696e44f0dbb5712c17349c08794ba05577e4b65ca026e66b00202dbda22eb56d870a
SHA1 hash: c64131af069fba4c6379ed7287bc8be09f9e5858
MD5 hash: c7d9a9072c6c3edcd231abd61270605a
humanhash: double-nevada-yellow-hot
File name:c7d9a9072c6c3edcd231abd61270605a.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:465'408 bytes
First seen:2021-07-23 06:24:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 13012c7764c22db0eea00ae6b1458d85 (7 x TrickBot)
ssdeep 6144:ybRfnjXFr2KpL3bbHHjYXWOZcy8QGd37ci/fW6/gNXtlTF5yVNU5JhJDCyFE:UZr2AHHmjMd1W6/gNXtrkVQhJDrG
Threatray 3'522 similar samples on MalwareBazaar
TLSH T10EA4E02C3480F4F6E0230175C9999665CAADB8247B2378E7E7C46EFA7F655C09A3431E
dhash icon 80a1ecf4f4687000 (7 x TrickBot)
Reporter abuse_ch
Tags:exe rob110 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c7d9a9072c6c3edcd231abd61270605a.exe
Verdict:
Malicious activity
Analysis date:
2021-07-23 06:44:50 UTC
Tags:
evasion
Link:
https://app.any.run/tasks/a843619d-ac7b-486e-8266-9aea1e80825b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/173537/
Detection(s):
Win.Malware.Generic-9880574-0
Create hunting rule

SecuriteInfo.com.W32.AIDetect.malware1.13546.8288.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b77cd0a4-c140-4844-86b6-a1fbda83d797
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/820571
Signature
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-07-23 06:25:08 UTC
AV detection:
29 of 46 (63.04%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
101c5a5784112e7fa5c2f766476dff8663021e2101c8d4569cb5698390cb4636
TrickBot
2c773049e4974dfd199134bdb84cc99cfbe76a6f09996d87e9219767527e5034
TrickBot
960646ac3782c54649f7feabd562676d2c7ba0ccf76e6bb868f0570d1e42876e
TrickBot
9e2c9fa5f0c1bd5348d3a6996ab5855104ac9580defad7789f4296ce9d5305a0
TrickBot
d9b9cbd9fd559edd3cf9e386bf6324be90c69902adfc7817d81a95fe4d18a8bf
TrickBot
e02ec4de6280d08990fa9171ab6cea14be9042af8768645f19823fbab87f68d4
TrickBot
e4d2675a178319609e0b022d9dfed2b6e68d1d269b0b4e25ed63cc24f7296841
TrickBot
+ 3'512 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob110 banker trojan
Link:
https://tria.ge/reports/210723-7qevb2n9tn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
Unpacked files
SH256 hash:
c4b678899879a9a33fe356a941f635685a72254d5982aa29d25c16396ddb16ea
MD5 hash:
d7f559b5548e77b31cca00fd300a4ef5
SHA1 hash:
5d8e8a884deebcb636c30a6e9497b21d867eef66
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/c7fe1e33-a9d4-4331-94ca-ecebf8d8f204/
Parent samples :
2c773049e4974dfd199134bdb84cc99cfbe76a6f09996d87e9219767527e5034
101c5a5784112e7fa5c2f766476dff8663021e2101c8d4569cb5698390cb4636
960646ac3782c54649f7feabd562676d2c7ba0ccf76e6bb868f0570d1e42876e
e4d2675a178319609e0b022d9dfed2b6e68d1d269b0b4e25ed63cc24f7296841
9e2c9fa5f0c1bd5348d3a6996ab5855104ac9580defad7789f4296ce9d5305a0
d9b9cbd9fd559edd3cf9e386bf6324be90c69902adfc7817d81a95fe4d18a8bf
b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0
b7da1ed4d4b5461005d4a9ec7e54c69bc4a86ba94571c0c61840987bf87af1ab
SH256 hash:
b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0
MD5 hash:
c7d9a9072c6c3edcd231abd61270605a
SHA1 hash:
c64131af069fba4c6379ed7287bc8be09f9e5858
Link:
https://www.unpac.me/results/c7fe1e33-a9d4-4331-94ca-ecebf8d8f204/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe b1b3b7fb1001ef85e2894bb0356334683dcac037a787e439e51a250e26c498f0

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/173537/
  
URLhaus
https://urlhaus.abuse.ch/url/1473413/
  
Delivery method
Distributed via web download

Comments