MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8
SHA3-384 hash: 5a0b0f47806a7f457fb45f6332ab57552c24590040d66f51e37fef6026c90c81e7fbfd3a56326f250be0f0aa019de2ab
SHA1 hash: 2e448ca3f0ba5a0f1de1ecfa134f5bdd55e8d5dc
MD5 hash: 4b9920193b7845d42508219df0482da2
humanhash: beryllium-mississippi-idaho-moon
File name:4b9920193b7845d42508219df0482da2.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:393'216 bytes
First seen:2021-09-30 05:50:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 17a1fa7a17d3ddbef1b7dbee846d558e (4 x TrickBot)
ssdeep 6144:ZvxsZNEIrAorbtYrHY+y1h0mEqe3MW5yX/+wloufsYPOHxCiG:9xsOorerHX1v8We+wKuDPuMiG
Threatray 3'683 similar samples on MalwareBazaar
TLSH T1BA84E10271E988F2E2B299300DB56B35AF36FD744F71CB8B2354961E1D364958A3B363
File icon (PE):PE icon
dhash icon 18f8bac6e66e7818 (4 x TrickBot)
Reporter abuse_ch
Tags:exe lib153 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4b9920193b7845d42508219df0482da2.exe
Verdict:
Suspicious activity
Analysis date:
2021-09-30 05:57:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1964aab1-d51f-48dd-8f81-5c2e49bc412f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/193333/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47076372.26080.28119.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1dfd22d9-61f4-477e-9509-5afa45eac0d6
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/861549
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-09-30 03:58:29 UTC
AV detection:
10 of 44 (22.73%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
16f5c54bb382796b4e1bac32286ca9d8fd795564e689f8c69fc3c4de036359ff
TrickBot
226321291fa1d596e9a0dc89992fc3e36eb070d06c02df249593a3193d216ed3
TrickBot
55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c
TrickBot
5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49
TrickBot
6c238a124150dc1298bd6a347e8628b51ca2d5ae04b0181270a5928aedc63ad9
TrickBot
d123ffe07c4db0343645678c0ea21a4201debded89f22ca043cf336a77f6a082
TrickBot
e5189997d295c9353162b5eebf001413df093a774cc7edabd67e9f23daa3a112
TrickBot
+ 3'673 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:lib155 banker trojan
Link:
https://tria.ge/reports/210930-gj64yageg4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
f9b8486bb9309201ab1b7a75e4e10066361c3f47037e8f3112c8a9590120395f
MD5 hash:
09240d22d256f68513f0d6d650d888b8
SHA1 hash:
dd7157222ae0a541e1b6423c2a3d250e47a5f657
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/389ba2b8-582e-4843-95b1-9abe04b3603e/
Parent samples :
55c2b8273385d3a14d5fbcca6209a31a040238c656b7f45f217469f412d4e28c
e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8
012ea56386ce7509c1950a04da161e76535ae5aaf1f834eedc94c84a18ebdb47
SH256 hash:
fbc0ddd90d93fcc3fbd450bbd4b3de790ae19c1ddef8b9be4338eacaf646bb88
MD5 hash:
b6fe5e0e8a0a0703396f661046f00b84
SHA1 hash:
74ac85dd55e7ff2d96e542bf89c3916dd2b5c3ca
Link:
https://www.unpac.me/results/389ba2b8-582e-4843-95b1-9abe04b3603e/
SH256 hash:
d8cfa7f2c2fd9e491e99bec518197528cd737477ca8194a35dfc885caf986f9a
MD5 hash:
adb891461f1ff1c9f176bdb92892a212
SHA1 hash:
1ebf2b98b5c0489af19bfc5a4bf63f5c17d1dda7
Link:
https://www.unpac.me/results/389ba2b8-582e-4843-95b1-9abe04b3603e/
SH256 hash:
e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8
MD5 hash:
4b9920193b7845d42508219df0482da2
SHA1 hash:
2e448ca3f0ba5a0f1de1ecfa134f5bdd55e8d5dc
Link:
https://www.unpac.me/results/389ba2b8-582e-4843-95b1-9abe04b3603e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e10cdd8dad0c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe e10cdd8dad0ca6af62e353581ace45962c1704557f802ade5be9126b5103f2f8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1641957/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/193333/

Comments