MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de5648abf555a4574df8ebf2d2b75dde4ea73639662ae62bf62a109a54f14fd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	de5648abf555a4574df8ebf2d2b75dde4ea73639662ae62bf62a109a54f14fd4
SHA3-384 hash:	56b339389204c9769504961188947ddcab240a00818e43de8d9812450ae407a4b0287e929d37b1cbcd4d0952cc05810a
SHA1 hash:	ebfc03f11051b4034df9e988520c2c2bd496b381
MD5 hash:	df853ad724ccf45d3008a55fc8b89b3c
humanhash:	east-florida-island-item
File name:	putty.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	707'584 bytes
First seen:	2020-06-28 18:04:22 UTC
Last seen:	2020-06-28 18:45:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	57c390af9293cee083b29d2c64084ffa (3 x RedLineStealer, 1 x TrickBot)
ssdeep	12288:ms6IRgIQDGgDUPhsnHYJuG5I+GQb2hAtn/kpDiQAOLrW5FQ:msJSTGgDUJnr2hO2AP
Threatray	5'022 similar samples on MalwareBazaar
TLSH	31E4123232F1C073E46721316C9192B215ED7C625771624B3F9A2E3F9EB27911A3D39A
Reporter	abuse_ch
Tags:	COVID-19 exe TrickBot

abuse_ch

Malspam distributing TrickBot:

HELO: gateway24.websitewelcome.com
Sending IP: 192.185.51.35
From: chagerty@seasonsnurseryinc.com
Subject: Our coronavirus exposure
Attachment: application_coronavirus.xls

TrickBot payload URL:
http://170.130.55.135/api.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/15238/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Gathering data

Threat name:

Win32.Trojan.TrickBot

Status:

Malicious

First seen:

2020-06-28 18:06:06 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3zlerk7vkwsfotpy5pznfn253zhkonrzmyvomk7wfiijuvhrj7ka._file

Verdict:

malicious

Label(s):

trickbot

TrickBot

42e45424667f654499511b776d930ffab2947be59d50b555662456363217d32e

TrickBot

4fdbc0f95b04ddf2f8682c396aa6a39686988be348fecdf826a171de4972fed7

TrickBot

701363cb0a124199dda3a8e0576fb4814bd808053b7f67457a16dceb78a37028

TrickBot

8266f6ba4cfed70b35b8eaff7795a27ceb56f29478f146659921d76e8b55bca0

TrickBot

8a78aa706a8e1f0c48707d0b1e5cc3c1cd2c296872d75685b7c7b7dd0439e17b

TrickBot

8aea489c018329f23d463e8459b38f442527ca1ad5d2a95d84eb7790e75a2246

TrickBot

9e4f19131dff831473756efdc94680ccf95174ff255a707aacce411196bd1e3d

TrickBot

b3096cb8218ff67108c5de0e4b969bfbe73f0f2e5fb4df718eb48dc05047fbf2

TrickBot

e23514f8b50a9b23fca4ad0ac430e35ee9ac847bd4cfb71cfcf0f7c3b343b5b7

TrickBot

+ 5'012 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

trojan banker family:trickbot

Link:

https://tria.ge/reports/200628-ksqfqk69ks/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Trickbot

Malware Config

C2 Extraction:

95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449

Please note that we are no longer able to provide a coverage score for Virus Total.