MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b64bd0c75c5d94c97dd2fdf056a1078bfc05b26f655bb02f415b7a122c51e818. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b64bd0c75c5d94c97dd2fdf056a1078bfc05b26f655bb02f415b7a122c51e818
SHA3-384 hash: b870ffe1e12c77507ea3a56bb9aa9be05c4b0ff13cee47bad7a033733e25bad5fcee07a08d8dd18267aa1b67b1a4f077
SHA1 hash: 2da5d40839d74e20d62323da570f23fdc440c4f0
MD5 hash: 3b21f9bace5623fa8e1fe26df3b5ca46
humanhash: queen-tango-maryland-zulu
File name:62EYJSFYHMS.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:766'054 bytes
First seen:2020-05-05 15:56:00 UTC
Last seen:2020-05-05 16:54:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 30625d671f2d3abf2a3e2df54581f47b (312 x TrickBot)
ssdeep 12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOml
Threatray 2'889 similar samples on MalwareBazaar
TLSH 22F4B32F8EBC4E13E5D4C2F03E368E5CA6D65C19F84C65AE53043E8A2E637322D5456E
Reporter JoulK
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.20ee34e01ac25807.25233.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 01:14:26 UTC
File Type:
PE (Exe)
Extracted files:
30
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzf5br24lwkms7os7xyfniihrp6almtpmvn3al2bln5belcr5ama._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
04467d42b0d94e410ca59e4ccb84cb7905222fe9cd9243786134f4e96c3c217b
TrickBot
3b4b6643b53452dc519bad7b6657a1fff4fe2e914968c3b2f4557b90d3d52716
TrickBot
3f2611a2827fdd2f35ab054308a75e6cf23543d8c6bdd59e37f128670c7ee00c
TrickBot
585f8b5eda81fdb72e7c3ee59ae124cb3f712ea5a53e6fb1af1f7de9afeb872c
TrickBot
6dee5907e6d007cc2dc812b55861636e8f75cbf5dbdc3f08f0316309072ac6f0
TrickBot
7a45cd24ed533d0d8db87c2ea3d22996d9b2d3433f26f245486f2c820a6b5be5
TrickBot
827000255e03ed86fefdc855baaca19962f7fd96c6ae9aa308ce3e681de449df
TrickBot
8c3b0a5946603ec985029259dc38fca8b70159001f7c5332ad55f05d2e7992d6
TrickBot
b86041236bb9055d5439e8118a90d255e9ec8da338c09caacc9a35195001acaf
TrickBot
ca490c5b99ac333cb94ba69bae270b6e1e4616bd50c83eb4c109153721f81c99
TrickBot
+ 2'879 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:ono41 banker trojan
Link:
https://tria.ge/reports/201109-2vka529qcs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/357729/
  
URLhaus
https://urlhaus.abuse.ch/url/358080/

Comments