MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
SHA3-384 hash: 7b308856aeaced34425465767447d18755ab547f02b662284869747400e2ad4998734027b295386b0ffb40dd51f74fbf
SHA1 hash: 139802eaacdb585754aa9e9452c8b60a8af1a9ac
MD5 hash: 374341fc4c89f820a1377db72b96435a
humanhash: west-fanta-illinois-ceiling
File name:c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
Download: download sample
Signature TrickBot
Create hunting rule
File size:122'880 bytes
First seen:2020-10-24 21:04:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:2TilrHtPlQ+zIKzZ3vMYumu/3/mbQn6j:lFlmIfumuWbb
Threatray 1 similar samples on MalwareBazaar
TLSH 95C32A06E6C3D2B1EEC604B0126FF77F59620221A702AEC3C7A11D12A9515F36B3D79E
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
148
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75257/
Detection(s):
Win.Packed.Trickbot-9633235-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/508751
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-05 14:27:39 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zewi6zqripfgn4xv77tbtxmrbempquif32netw3ykjq7qaza5boa._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/201024-6x836dhh7a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Modifies system certificate store
Trickbot
Malware Config
C2 Extraction:
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
Unpacked files
SH256 hash:
c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
MD5 hash:
374341fc4c89f820a1377db72b96435a
SHA1 hash:
139802eaacdb585754aa9e9452c8b60a8af1a9ac
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6d15dc4b-9f19-46f7-af97-cf6e0b8cc85f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75257/

Comments