MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
SHA3-384 hash: cfc5536bf8f4af4d34f2254163254e1406875d1e92b7e0336a366ed3175182e69a065e3c0751838fd41e7f306aea2672
SHA1 hash: 7c9ff4a71756b6d8329183294669aabab59195ee
MD5 hash: 5e138a79931adc0c76b0b6ae46d90433
humanhash: april-wyoming-mississippi-earth
File name:e21f86a0329f9fca7eb0492f22d76125
Download: download sample
Signature TrickBot
Create hunting rule
File size:614'400 bytes
First seen:2020-11-17 14:46:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8d30e57c6a35a6f8994c5967f3d6d712 (4 x TrickBot)
ssdeep 12288:kFBfWwcRr/SjzTPMPpWygb2xglS/ORfEGT9cpPFTj:GzyzxglSVy2pPFTj
Threatray 6'559 similar samples on MalwareBazaar
TLSH D9D46C135DAD65E0E15205305E3A5F65283BBC263850EA4BD7A0BD6CE873783E8B532F
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Connection attempt
Unauthorized injection to a system process
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 14:46:58 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
TrickBot
2f84b8a85106e702ca8a3b71db94b1dc8dda5173e9e7b1f672b28c07d37f57ed
TrickBot
34873d81dc7a0468d941294a1c62f9bb9e110d0f333f55de2da41ac6ead400d7
TrickBot
4b592bd56c7d722bc226dcd4c37630c2483f3771a71e7d4f7e57e9ffb867458e
TrickBot
52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
TrickBot
58c4bea082b2f44f0beab5356ae2bc9bc73c3f13ab0491861bc2ba24690da103
TrickBot
648d3b8639ff54b8741ec84898b213836594539de6f0c11a6c9f34dccf5e79fe
TrickBot
6ca141e8ed2443113c9e497d231b93cf41d86b224993c48f589b375a830cd27c
TrickBot
bfa088b1ea61efa003343b09a536eaffa12bc90fb612f8ebcb8182785bb6eb16
TrickBot
ea5c72bce7e028a6b2f9febd90751bf0e323da00b4b0d68be2a52ed21fe2a4d0
TrickBot
+ 6'549 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib7 banker trojan
Link:
https://tria.ge/reports/201117-5htrw7hdq2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Trickbot
Malware Config
C2 Extraction:
202.136.89.226:449
202.169.244.252:449
203.176.135.38:449
212.3.104.50:449
41.203.215.122:449
41.41.179.239:449
43.239.152.240:449
43.242.141.59:449
43.245.216.190:449
43.255.113.180:449
45.230.8.34:449
45.233.25.6:449
78.138.128.20:449
49.156.41.74:449
Unpacked files
SH256 hash:
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
MD5 hash:
5e138a79931adc0c76b0b6ae46d90433
SHA1 hash:
7c9ff4a71756b6d8329183294669aabab59195ee
Link:
https://www.unpac.me/results/d1ebfbf4-ff49-466a-8c53-d005cdc5c4c5/
SH256 hash:
234e80062c3071b002edd4c9ddccb1781fd9cd1d1f5b011f223ca64dcc3c323a
MD5 hash:
0742a066a92f5940a2a5fd8ccf035519
SHA1 hash:
635f56dfe2fdee72f43648f5e350ccb93f504517
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d1ebfbf4-ff49-466a-8c53-d005cdc5c4c5/
SH256 hash:
e4ffade6a267935b4f699cbe9de7b4d716edb735f3fd52434dc7c62c0aa570ff
MD5 hash:
949ffd4f39b63905165149fdfbc2a855
SHA1 hash:
1269c4afeaa03297558e3e793a624885eff46daa
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d1ebfbf4-ff49-466a-8c53-d005cdc5c4c5/
Parent samples :
7c248c8b222262373683f1dbf35e4cee1072cf3cde93641dc62037416e043402
494180c6b17283d1a883e6f69061e7b6ba8b054f08aa590e403e7c490e24ef9d
126119655bf88be629e8cb7af17b74ed7316557a170e43bb518ce3072d1b6aef
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments