MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc
SHA3-384 hash:	e54c0335b5767ec7d052338963b2da2249c37d5f75e482d49788a39dce08b0197ea71c74d193c93d97fda79ba779f56d
SHA1 hash:	e9f28bc1f3cd9ab45a794e98692c37a3998c1d34
MD5 hash:	1455edae3e1fd87e3cc52c736245209c
humanhash:	video-sad-charlie-black
File name:	1455edae3e1fd87e3cc52c736245209c.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	692'267 bytes
First seen:	2021-10-28 15:56:16 UTC
Last seen:	2021-10-28 17:14:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7ffe85aa6061465054775c61556ce3a7 (3 x TrickBot)
ssdeep	12288:0bJ2lCSCeOVkk+8x2fU3JXeqZNEo9v3cOvhkMDfdVl/Cxofh/Q:vCeOVv+8xtHEqcMyEfd3Cxofh/Q
Threatray	4'217 similar samples on MalwareBazaar
TLSH	T150E4EFA17B95C1B7E6B201750FF63B3596FBE9600F207BC323844B5C5A328D14A3A766
File icon (PE):
dhash icon	71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter	abuse_ch
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

361

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/200993/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.47275989.16672.9134.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

TrickBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fca0fd34-2b2d-4930-a921-6c9b0d66b5a9

Result

Threat name:

TrickBot

Detection:

malicious

Classification:

troj.evad

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/878740

Signature

Allocates memory in foreign processes

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc/

Threat name:

Win32.Trojan.TrickBotCrypt

Status:

Malicious

First seen:

2021-10-28 15:57:05 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqjutxewwep6yr7foshcgbn5pufbjjfrle5ggluulqvjazmfhc6a._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

061489cf971a1b984d5eba4d9542972bc755179d5bd6539bdb9852259ebbb565

TrickBot

074870cf4c7b80cd7e61c731dcae68c1707c55457ef1004c6c32cadc1fdf5206

TrickBot

3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e

TrickBot

784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e

TrickBot

e5189997d295c9353162b5eebf001413df093a774cc7edabd67e9f23daa3a112

TrickBot

f05c92792d04b23c27f7be6a5fbb318c77acd998d2ada2823e0ae62d05adb0af

TrickBot

+ 4'207 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:lip142 banker trojan

Link:

https://tria.ge/reports/211028-tdxpjagfcp/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Trickbot

Malware Config

C2 Extraction:

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Unpacked files

SH256 hash:

4e94134e1104bff113f31ec83ae3b0e143c6e3663272cd8c28554ad136d09271

MD5 hash:

0fc0d76761f8bafca954cb7fdc172eb4

SHA1 hash:

a451fe8dc546b939d95b67c87c0a9d9c40409288

Detections:

win_trickbot_auto

Link:

https://www.unpac.me/results/a6899720-61a1-40fc-9f2b-e1579f77d368/

Parent samples :

bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc
734f8fbef8f83ac79bb0fa464a091889c6cb044b4e2a3471138ff766785e2361

SH256 hash:

1dcacacccff1eaa12757dde24b8125272c07ff1def6289ceeefd1dce5b51019e

MD5 hash:

211540344b333258bfe82318f6a3a62a

SHA1 hash:

6b91ee700b4ac688a07e903a750dbc3cc0dbcaa5

Link:

https://www.unpac.me/results/a6899720-61a1-40fc-9f2b-e1579f77d368/

SH256 hash:

c202dccf5147a8e294bab1a01ebf3d4d240b5854454ddfb68fad2ec7af9fe9cc

MD5 hash:

56217e982a17c346c7d4701a623e24f5

SHA1 hash:

0332bc92a697b4be2047f755de84c1cb2959225a

Link:

https://www.unpac.me/results/a6899720-61a1-40fc-9f2b-e1579f77d368/

SH256 hash:

bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc

MD5 hash:

1455edae3e1fd87e3cc52c736245209c

SHA1 hash:

e9f28bc1f3cd9ab45a794e98692c37a3998c1d34

Link:

https://www.unpac.me/results/a6899720-61a1-40fc-9f2b-e1579f77d368/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/bc1349dc96b1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bc1349dc96b11fec47e5748e2305bd7d0a14a4b1593a632e945c2a90658538bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.