MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15
SHA3-384 hash: aba77a69b9d27257f5cb390b87a8c783fb37d3be25a064af3de8eaa9eeb71012ff08e72f419fe9e4ca0b680a82653003
SHA1 hash: d0ff741a27574f258a76efbceb9c1f55f0819f05
MD5 hash: d44938ec0099b514c0960b05e4895893
humanhash: violet-skylark-west-hawaii
File name:d44938ec0099b514c0960b05e4895893.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:446'464 bytes
First seen:2021-10-02 16:00:26 UTC
Last seen:2021-10-02 17:24:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 220580f49c2724e661575b7bf3bd58ea (13 x TrickBot)
ssdeep 6144:pkVJ67JhvuooFgbJhMZnctQTFE4QbXU9CkDotFMcMNBlNtEKLtc:pkVJIDvZyklOFfQbXU9s79MNBjKotc
Threatray 3'919 similar samples on MalwareBazaar
TLSH T12494E02A36E0C973D5AB01314EF5AB79B7AAF9100F715A4F33904F0E2D31A52562A376
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:exe tot157 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d44938ec0099b514c0960b05e4895893.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-02 16:07:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/71edb641-ea42-46bf-a3b4-cce5ecc1b38e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194227/
Detection(s):
SecuriteInfo.com.Trojan.Agent.FNRH.16745.32658.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b45c4bc-2afc-4559-8b20-f1fc0815e235
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/863226
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-02 16:01:23 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
3816e3845184a41e9c7a1bcb9dacd089e712f72fff6f44ab4d55d563b0177652
TrickBot
3cdd741fb186596e2c6654737c86f6143b6c130a3f51333346e252f74dafc78e
TrickBot
473dfbecc3818114569a9a9f80b0a51ad74b3d88fa778158ab145e839ecb042c
TrickBot
5f98da253ec5d1ffbbe07b9ee727a8d8162911b70d59d905f2a2f52579f524d2
TrickBot
9a5d5f4144492833b2f5368bf39154e0a5d60914afccbfde1db93cf0cd9db000
TrickBot
abd7a64e1bf9248c1e53f32ea222a1e448132346edb55a3dbca55354bc3488d1
TrickBot
b88d012225e5e8af014bea93cd04c3655f9b46c77f06557a857868ceda46153a
TrickBot
c6ea628cd3252582504cdfd64aafd7f44711822c90d0ac1e3deddb7fa3ece997
TrickBot
c9a17531e2ae6361f893390f51295609f4a2fde60927a9afeac9a9e0c4fc2660
TrickBot
d76bcc765a822ded81cf1518ab3d65e08cc42ccf946d9381d1115934abe6fed5
TrickBot
+ 3'909 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:tot157 banker trojan
Link:
https://tria.ge/reports/211002-tf8jtaefcq/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
21e0353f41cc263d0ae646c43fdadbdbd833d4cbb1cb3e39769ba830c1f6e71e
MD5 hash:
0d28a04708bff5e527ede64be3856765
SHA1 hash:
5c32eddffb8ad1c290f42f6be1dd1c814f97644e
Link:
https://www.unpac.me/results/3111bdaa-899b-490a-8663-a042f2e6259d/
SH256 hash:
f68656950c7b735e8117b5d44d18531f3cc0cca9d48989b85fbbee3377c61112
MD5 hash:
4f2cb2726bc96b7d2de1add4aabf64f7
SHA1 hash:
337cac471488d0b377c85ff303175e0fd1e26a08
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/3111bdaa-899b-490a-8663-a042f2e6259d/
SH256 hash:
dcd35b7c4fc2419e993d562c93bd9c30753c3bffa2fd619474335d3bb70702b0
MD5 hash:
56b02833a1d9df846b563b2ccc3fffed
SHA1 hash:
8f4f1f345e2258ab5d0444d87bfe788db97f2bca
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/3111bdaa-899b-490a-8663-a042f2e6259d/
SH256 hash:
d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15
MD5 hash:
d44938ec0099b514c0960b05e4895893
SHA1 hash:
d0ff741a27574f258a76efbceb9c1f55f0819f05
Link:
https://www.unpac.me/results/3111bdaa-899b-490a-8663-a042f2e6259d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d8dd18ebca4b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe d8dd18ebca4bef772398f5d84179ef8b68b9f56e2a1973f872006ec32a64df15

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1641958/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194227/

Comments