MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b37f2f696a1bc7ba2ad63bda8d7fc30d0e3b9fdbd00a6de35db2b47b9f40beca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	b37f2f696a1bc7ba2ad63bda8d7fc30d0e3b9fdbd00a6de35db2b47b9f40beca
SHA3-384 hash:	d32c0fa7b4cdf9644f42d30e832190e003b99ff7466301c8a5549c1c87af4de0e83c3c9f788c018d4e3f051b9cbab714
SHA1 hash:	0b0e03f050e3310ae92100cb139483b08ff8aa2e
MD5 hash:	e8195369ec4f1fa72377963e1651705c
humanhash:	massachusetts-carolina-charlie-minnesota
File name:	74EYJSFYHMS.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	766'325 bytes
First seen:	2020-05-05 15:57:59 UTC
Last seen:	2020-05-05 17:31:45 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	30625d671f2d3abf2a3e2df54581f47b (312 x TrickBot)
ssdeep	12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOml
Threatray	4'793 similar samples on MalwareBazaar
TLSH	89F4B32F8EBC4E13E5D4C2F03E368E5CA6D65C19F84C65AE53043E8A2E637322D5456E
Reporter	JoulK
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.20ee34e01ac25807.25233.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-05 01:14:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 31 (90.32%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wn7s62lkdpd3ukwwhpni276dbuhdxh632afg3y25wk2hxh2ax3fa._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

1986a3c4ee3f9c1f66d2b8f305f55227699aa5e61b86f651f3d2dc313d42fee4

TrickBot

461bdd6ca5ed64172f4cc0e58e9aff3f7770f238f9ea2abbc06d6761625dc2a3

TrickBot

53d53c749f19a49268145e0c0b6fa077730f46f6b7bbae4087e0acf051f1e80f

TrickBot

799888078bf038a69c829f68cdc58c558468fc8cefa9c2a4a6c435f153f61822

TrickBot

a0f068ea09ea33fbe3a0e7aca0f9c9fcb095bc2665b52ed51ba25e70b411c428

TrickBot

b290b333f6069550f1535744c3ea1a681f4e02fcaaa04217975b403e49feca91

TrickBot

c79453627ab01089d9b57b1d2dd16f16891a70f7c3966b383fd235853854e8d3

TrickBot

c8f83ddc45a3641e5dfa0cb51f76af8401dd809407973a89672d0195366084ec

TrickBot

ea38f3c7c3c093009aad5ac8816fc8084a4a0882134f7aa7952b290c00d6c9e2

TrickBot

+ 4'783 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:ono41 banker trojan

Link:

https://tria.ge/reports/201109-ew2dj9kxd6/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Trickbot

Malware Config

C2 Extraction:

5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449

Please note that we are no longer able to provide a coverage score for Virus Total.