MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7c8353673369dcd293b0160fd35a9143ceb4ee98ebb69d8617b596b5fd5244d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c7c8353673369dcd293b0160fd35a9143ceb4ee98ebb69d8617b596b5fd5244d
SHA3-384 hash: 731b2b4f4cac9f15dca1fc7f2a74beac3f2ec2f1e8a58fe9591196cdfff7f229efe0824f26bfa624aba9b3b79707502e
SHA1 hash: 92df1e2169d594f6ebf002ba7425e079c578df58
MD5 hash: a15a26eaab284849aac05f2e3cec7cb6
humanhash: bluebird-apart-white-snake
File name:a15a26eaab284849aac05f2e3cec7cb6.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:729'151 bytes
First seen:2021-11-15 09:14:51 UTC
Last seen:2021-11-15 11:14:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b1583b0de68b5707a7d41293f45591df (9 x TrickBot)
ssdeep 12288:UzzV0Xl2T+4FdlzIePSMbEyJfXtRvE+hTXYzW:Y0Xlp4FLzzaMlFzlhTIC
Threatray 4'112 similar samples on MalwareBazaar
TLSH T118F4E06236E48076E5BA01320EB6773A66FAE8644F75FBC71390974D9E320C14D39367
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
369
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/205848/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.79877.26864.27005.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Sending a UDP request
Connection attempt
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/6192251b3edf00a722d5122c/reports/754debc7-3f48-4265-910a-179a4b839423/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/76601b73-675d-4e40-a8dd-35d899608559
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/889281
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c7c8353673369dcd293b0160fd35a9143ceb4ee98ebb69d8617b596b5fd5244d/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-11-14 19:28:05 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=y7edknttg2o42kj3afqp2nnjcq6owtxjr25wtwdbpnmwwx6vergq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0014daeadce3a90746e84a3ddb7388be202598fba7dc67826550df3456e70941
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
d418e24f1da80e970160a4192050392dbf3e50a89458f46dbbd753423ebdbbde
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
f723a66d74e36a5e249a72c8f2a4cc4a7a313ecbf83198df5d377bb52f452768
TrickBot
fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
TrickBot
+ 4'102 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot177 banker trojan
Link:
https://tria.ge/reports/211115-k7w6eshgb7/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
42438fa30903f231517762c4cfb2cb00e9cc9d34f07742209993cd317a8d4d18
MD5 hash:
7807a193d659ea83e2b202a961411d0d
SHA1 hash:
81d519ae04121c7d0bf7e995548ddd4e7ec92c5b
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/387717ec-03da-4d8d-91c2-58a1506d4a42/
Parent samples :
c7c8353673369dcd293b0160fd35a9143ceb4ee98ebb69d8617b596b5fd5244d
e134e7b7e1960e3809b8748244e881b39f437a27be9a75c5b2a4c80fd60d1479
SH256 hash:
ff5e01d1f1ec2bd985bb80c906075ca4a95e08eb571c34cd8235bbd75ca18167
MD5 hash:
f88c52a352530d1e254a66370642da06
SHA1 hash:
1c8fb4cb863cbe2e0ff7005d8e5767f285812e38
Link:
https://www.unpac.me/results/387717ec-03da-4d8d-91c2-58a1506d4a42/
SH256 hash:
d6277dc5ee1f7bf687c9294403c811b7206f6923a15ec53df4adf935b053f9a9
MD5 hash:
b40c004e484e94a90e531f7de859e2eb
SHA1 hash:
afcd37789cb68da701edd793244e830b577cd053
Link:
https://www.unpac.me/results/387717ec-03da-4d8d-91c2-58a1506d4a42/
SH256 hash:
c7c8353673369dcd293b0160fd35a9143ceb4ee98ebb69d8617b596b5fd5244d
MD5 hash:
a15a26eaab284849aac05f2e3cec7cb6
SHA1 hash:
92df1e2169d594f6ebf002ba7425e079c578df58
Link:
https://www.unpac.me/results/387717ec-03da-4d8d-91c2-58a1506d4a42/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c7c835367336/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe c7c8353673369dcd293b0160fd35a9143ceb4ee98ebb69d8617b596b5fd5244d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/205848/
  
URLhaus
https://urlhaus.abuse.ch/url/1755435/
  
Delivery method
Distributed via web download

Comments