MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9dc4bf3de105f4aa2b4f90b8893d9a0d1273cc81bf2be0e00b0700b15970f98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	d9dc4bf3de105f4aa2b4f90b8893d9a0d1273cc81bf2be0e00b0700b15970f98
SHA3-384 hash:	158bfa67a23a11f4236d5d4cc885a8bb3e19a9865d51b01e35241f07a89a007708b81cdf3eb74301d3af599efaa36323
SHA1 hash:	ab881ba613850f128d2334707b39e1520d86dea7
MD5 hash:	502bcaab33f214a4b7f616503e597789
humanhash:	iowa-massachusetts-hawaii-thirteen
File name:	Documents-invoice-37.iso
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	1'869'824 bytes
First seen:	2021-10-20 17:10:59 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	49152:JOkkXuEs0GpGwx4JaTD6ydQD1xR88sxq57nN:yXuEUX4
TLSH	T150853B8AF9B38083EB95ACF92716179045831D791527A133BAEEF5E8A3BB531CC53350
Reporter	ffforward
Tags:	iso leg1 TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

402

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Heur.26304.1472.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

67%

Tags:

packed

Link:

https://www.filescan.io/uploads/61704da89a5a1e91c5c8991c/reports/1a2fa248-d264-4b17-aa1e-dd362c4e3a73/overview

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9dc4bf3de105f4aa2b4f90b8893d9a0d1273cc81bf2be0e00b0700b15970f98/

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:leg1 banker suricata trojan

Link:

https://tria.ge/reports/211020-vp9nxaaccq/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Deletes itself

Loads dropped DLL

Trickbot

Malware Config

C2 Extraction:

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d9dc4bf3de105f4aa2b4f90b8893d9a0d1273cc81bf2be0e00b0700b15970f98