MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de
SHA3-384 hash: d8651da1eaa32ef2e8820580c2fbaff1b649635430464fca9518a21cddb9700d22b76290b0ca05ff8afb9310795ccf06
SHA1 hash: f2bdd875d441471db5151aec0710661f461d2d64
MD5 hash: 605cfa1c71057d161a2d5ba759f04d13
humanhash: purple-ink-cold-mike
File name:605cfa1c71057d161a2d5ba759f04d13.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:453'632 bytes
First seen:2021-10-27 11:43:35 UTC
Last seen:2021-10-27 13:27:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ea5a56b411909a74a5afb4f0920c62b1 (4 x TrickBot)
ssdeep 6144:wm18XMqwPrNX4zL+UwAuziXz6137wfP4IQv7q0CprAcJ35:p1r1rNX4zi+uzijA37CXQDq0Cprz35
Threatray 4'169 similar samples on MalwareBazaar
TLSH T1D5A4F12031C5C432E6B32078CDEA93718A29B8711F7469EBB7D816BE4F7A2C19935357
File icon (PE):PE icon
dhash icon 115060f4f0f972b0 (4 x TrickBot)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
275
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200489/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37876636.16608.16808.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61793b85db358dd15edf9c30/reports/0d97d216-08cc-4df8-83da-664ab8bb9baa/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d1326224-2840-4e24-a45c-662d322d493f
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/877691
Signature
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 04:28:45 UTC
AV detection:
22 of 44 (50.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
37c129eb8bb575d7ac12fdd14b5d05edee15c1230d7b712e5b9d2533f78dc5b4
TrickBot
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
TrickBot
61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e
TrickBot
cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415
TrickBot
dbd1cfed3d0b57ac4b4affbcd942287617d1f7bdd322ba2464d22020e4e29200
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
f05c92792d04b23c27f7be6a5fbb318c77acd998d2ada2823e0ae62d05adb0af
TrickBot
+ 4'159 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot170 banker trojan
Link:
https://tria.ge/reports/211027-nv62msefb3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
5d8a0d16111287531e348bf768e16204d7a99c4a5746b3ea41adf3e317db6f3e
MD5 hash:
7b1d369c1ae583bbc1513f61d9ebad05
SHA1 hash:
a5493566082072cdf5d9ce259d680fd73d310523
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/edf77c3d-2b57-4188-985d-17710febdeeb/
SH256 hash:
b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de
MD5 hash:
605cfa1c71057d161a2d5ba759f04d13
SHA1 hash:
f2bdd875d441471db5151aec0710661f461d2d64
Link:
https://www.unpac.me/results/edf77c3d-2b57-4188-985d-17710febdeeb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b980379d3c68/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe b980379d3c681f6c4278bc831365a5b3e4c4b8807172c7f5faa9d48ffebb19de

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1714994/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/200489/

Comments