MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
SHA3-384 hash:	43c7b6c51cc56f38a78a64add9423de0f0d2aeeea08b4d8116fdfd4505a530a84b39e1a04eddc495e2e4db7e659a6fdd
SHA1 hash:	c7adfe886aa3a088ab073e97e40d1eb3d06b7659
MD5 hash:	06d696dbd9166b9d5146f00749848b7d
humanhash:	seventeen-paris-solar-iowa
File name:	support.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	1'882'112 bytes
First seen:	2021-09-09 20:40:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	542a8c0c784537b1ec6f0eae4088f47d (4 x TrickBot)
ssdeep	49152:SVB3Xujk16sb2FX6CzYQsWGAMAjYbGMctIBR:SzXuQ16sb2FX6RnWGJAOGMca
Threatray	1'010 similar samples on MalwareBazaar
TLSH	T18795F1323AC2C078D12205328A59F76942EEBFB55F3243DB76DC9E1F5A715C1AA36213
dhash icon	cc8a539286e471b2 (4 x TrickBot)
Reporter	Anonymous
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

210

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

support.exe

Verdict:

Suspicious activity

Analysis date:

2021-09-09 20:41:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/311643d8-95f8-4efd-a824-3ed4ad078efe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/186738/

Detection(s):

SecuriteInfo.com.Trojan.Packed.140.20955.10125.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% directory

Deleting a recently created file

Launching a process

Forced shutdown of a system process

Unauthorized injection to a system process

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/ba2dda48-72ae-44f5-807b-add627ea3dda

Result

Threat name:

TrickBot

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/848437

Signature

Allocates memory in foreign processes

Detected unpacking (changes PE section rights)

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Found malware configuration

Machine Learning detection for sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Yara detected Trickbot

Behaviour

Behavior Graph:

Download SVG

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-09-09 20:36:41 UTC

AV detection:

10 of 45 (22.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2qr7acbs6rfudfngq3djdmxsbzk32tbrcrnegvq7qpy6uzq37rqa._file

Verdict:

malicious

Label(s):

trickbot

gozi

TrickBot

341186306bd4d9d32fa8e6cebaa58aba3756c9bfdc4d5bef3dd42acae7789fe8

TrickBot

342c6f896cfd65506ce1940e8c9902e47f2921830ca8085d1e2847fc7b7cb102

TrickBot

39adc7e2ea2a22034a153bb7d5eaba75ac81a26ddb0407bab5108242d1878c44

TrickBot

49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856

TrickBot

6b62e970d1c770e694aaccad7d7b874895731ed5c7c6029be9f6badc3b533332

TrickBot

ff2e1604b5ab04fc43039d5f94d08073f756115b1018846a253c0ad93ed94f8b

TrickBot

ffaa54fe26b7cb4b86bdb7d49a5b2e609cffdc3c3db9460a77f074b503988504

TrickBot

+ 1'000 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:rob130 banker trojan

Link:

https://tria.ge/reports/210909-zgek1sggc9/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Looks up external IP address via web service

Trickbot

Malware Config

C2 Extraction:

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Unpacked files

SH256 hash:

800a2fab8236daef038eda983c90ec9605e3da61c3ce7102ca34cd1761931c4d

MD5 hash:

0eee1eaecbcc25a0d917e8f66df95404

SHA1 hash:

706ae74b5e98b53970d10fc4aee9bf8776aafbfa

Link:

https://www.unpac.me/results/a9347c69-d904-4764-861b-813fa438372a/

SH256 hash:

d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60

MD5 hash:

06d696dbd9166b9d5146f00749848b7d

SHA1 hash:

c7adfe886aa3a088ab073e97e40d1eb3d06b7659

Link:

https://www.unpac.me/results/a9347c69-d904-4764-861b-813fa438372a/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/d423f00832f4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.