MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 7
| SHA256 hash: | bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16 |
|---|---|
| SHA3-384 hash: | 4665fa338d0a8a0c71480ec0ea100cfda5ce0f1479a7f5b23e6ffbafc427eebacd96c0c4e4f41fd2111ae70029bac163 |
| SHA1 hash: | 2ec006693189d6d9f9e1d1d0a244ea7086c83641 |
| MD5 hash: | c99e8ea05346c198782e4c66f01d7c10 |
| humanhash: | twelve-march-xray-nuts |
| File name: | Froggies.bin |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 413'696 bytes |
| First seen: | 2020-11-13 21:58:14 UTC |
| Last seen: | 2024-07-24 21:04:42 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 44250809348aaf9ac0c34782943fefc5 (1 x TrickBot) |
| ssdeep | 6144:YuLvVLAisXx49K7mRG5lAW2mndmPY/jtW+KITFyJSI6oTMEaAZlbI:HLvZoMG5lAKEYLtW9IT8ayi |
| Threatray | 2'938 similar samples on MalwareBazaar |
| TLSH | B194DF26BE505511FCEA11F108A4916875283C3266109E0BB399FFAF29355C3AEB7F1F |
| Reporter |  Scoobs_McGee |
| Tags: | TrickBot |
Intelligence
File Origin
# of uploads :
3
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Creating a file in the %temp% directory
Delayed writing of the file
Deleting a recently created file
Launching a process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Bsymem
Status:
Malicious
First seen:
2020-11-13 22:35:58 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
suspicious
Similar samples:
+ 2'928 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:fra1 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
195.123.240.138:443
162.212.158.129:443
144.172.64.26:443
62.108.37.145:443
91.200.103.193:443
194.5.249.195:443
195.123.240.18:443
162.212.158.129:443
144.172.64.26:443
62.108.37.145:443
91.200.103.193:443
194.5.249.195:443
195.123.240.18:443
Unpacked files
SH256 hash:
bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16
MD5 hash:
c99e8ea05346c198782e4c66f01d7c10
SHA1 hash:
2ec006693189d6d9f9e1d1d0a244ea7086c83641
SH256 hash:
058425264f9994bc6462e8cd9f3a28e99172a41e61163e027a74397781b1a458
MD5 hash:
8d4314242a4c92617c401e825e137407
SHA1 hash:
668ec13431a61fb7aeb45ee89bdbdad2aae57682
SH256 hash:
f998cd07758b31e7b4000278b6d2c957dd8f6470f85cb27857415bd56ba1e4cd
MD5 hash:
d9f54598ed460f5e98c819da4a2adb9f
SHA1 hash:
7bf99b0faa8bedca05e8cc5f65eec6f96dd4060e
Detections:
win_trickbot_a4
win_trickbot_g6
win_trickbot_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.