MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e1b67bd8b15bcd422fcbc74fa3b691c40c527ffedc951a6bb8e67ca257240d16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 7
| SHA256 hash: | e1b67bd8b15bcd422fcbc74fa3b691c40c527ffedc951a6bb8e67ca257240d16 |
|---|---|
| SHA3-384 hash: | 195d159a3878f3404901244b05ef582ed0ca2f5ef2d6848fc91798afc511e45e035a1244d0f7169a1338aa5ee4ad370b |
| SHA1 hash: | 97161441a9e2eb5b740ba25aea3b002b196baa13 |
| MD5 hash: | 5ed8ba344e7e14a158994bccc1d96882 |
| humanhash: | monkey-connecticut-uniform-uranus |
| File name: | supportdoc.xxls |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 698'880 bytes |
| First seen: | 2021-02-17 17:42:01 UTC |
| Last seen: | 2021-02-17 21:01:45 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 26d8e3bc1cb4099b5f3e98e0fd06d2dc (1 x TrickBot) |
| ssdeep | 12288:GXfYOpznbBv9SfHFZpchhbBKPy5LUg1egct0E:GXfYONl9SfHehXK+LUZL0 |
| Threatray | 8 similar samples on MalwareBazaar |
| TLSH | 82E4185045CB85EDF809F531B26AB05FE32FBEE2945EDDFDA6E130099A39ED01606702 |
| Reporter |  p5yb34m |
| Tags: | dll TrickBot |
p5yb34m
Source: https://destinostumundo.com/layout/supportdoc.xxlsReference: https://bazaar.abuse.ch/sample/e6c0c3ec0a525e10a61284f5afc61a8e4b6311eb8910a506b5358e513534e372/
Intelligence
File Origin
# of uploads :
3
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.Trickpak
Status:
Malicious
First seen:
2021-02-17 14:31:19 UTC
File Type:
PE (Dll)
AV detection:
17 of 29 (58.62%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
unknown
Similar samples:
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:rob13 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
134.119.186.200:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
45.14.226.115:443
85.204.116.134:443
45.89.127.240:443
195.123.241.195:443
188.34.142.248:443
185.234.72.84:443
108.170.20.72:443
94.158.245.54:443
134.119.186.201:443
45.83.129.224:443
85.93.159.98:449
92.242.214.203:449
202.21.103.194:449
169.239.45.42:449
45.234.248.66:449
103.91.244.102:449
118.67.216.238:449
117.212.193.62:449
201.184.190.59:449
103.29.185.138:449
79.122.166.236:449
37.143.150.186:449
179.191.108.58:449
85.159.214.61:443
149.56.80.31:443
Unpacked files
SH256 hash:
f1f41922cad42c54276a8dfcb0edf98d1f216d85aab419db389305e1e7fc7f90
MD5 hash:
640fedd6073021964a7a253ebabad529
SHA1 hash:
32d25f871e763ac069cce0fa06fb5835e4596038
Detections:
win_trickbot_a4
SH256 hash:
abc944ae200e08ab46466afc349cad4dd4c92bb852ebb50a1066bb0f89b3c322
MD5 hash:
d357305f523f60cd26f695c9383d0b6c
SHA1 hash:
298c7181b7880b129d1e620934ea8ac8eb4d40a1
Detections:
win_trickbot_a4
win_trickbot_g6
win_trickbot_auto
SH256 hash:
e1b67bd8b15bcd422fcbc74fa3b691c40c527ffedc951a6bb8e67ca257240d16
MD5 hash:
5ed8ba344e7e14a158994bccc1d96882
SHA1 hash:
97161441a9e2eb5b740ba25aea3b002b196baa13
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.