MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
SHA3-384 hash: af3bad1e6f4cc4606192fd5e582cc9ba9102e35eb2f25b145f4c77e2f6d443958a3a19a37cf0fc45eacab95a963d0290
SHA1 hash: 2e1c574cced0dad4facf88bf11998cdbe3354bbc
MD5 hash: da615e8e09f3f43fb778a4538eb75135
humanhash: four-lemon-mockingbird-paris
File name:e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
Download: download sample
Signature TrickBot
Create hunting rule
File size:131'584 bytes
First seen:2020-10-24 21:04:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:0bCDst7aakj5bIftN2/prM/au0tcv7239b6D:0mDsAawcfzQpGahcv7x
Threatray 5 similar samples on MalwareBazaar
TLSH 94D35A0EE6D3C2B4FF8505B41B7EA33F59654221AB219AC3C7A06C20AD511F3523E79E
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75238/
Detection(s):
Win.Packed.Trickbot-9633235-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Connection attempt
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/508756
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-16 23:22:30 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4i6qucj77knm6pfojes2icl5lh7nzwvusxs2edsg75nf7fkqvb6q._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
TrickBot
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
TrickBot
e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
TrickBot
fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/201024-42eeksrdtn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Modifies system certificate store
Trickbot
Malware Config
C2 Extraction:
51.89.163.40:443
89.223.126.186:443
45.67.231.68:443
148.251.185.165:443
194.87.110.144:443
213.32.84.27:443
185.234.72.35:443
45.89.125.148:443
195.123.240.104:443
185.99.2.243:443
5.182.211.223:443
195.123.240.113:443
85.204.116.173:443
5.152.210.188:443
103.36.48.103:449
36.94.33.102:449
36.91.87.227:449
177.190.69.162:449
103.76.169.213:449
179.97.246.23:449
200.24.67.161:449
181.143.186.42:449
190.99.97.42:449
179.127.88.41:449
117.252.214.138:449
117.222.63.145:449
45.224.213.234:449
45.237.241.97:449
125.165.20.104:449
Unpacked files
SH256 hash:
e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
MD5 hash:
da615e8e09f3f43fb778a4538eb75135
SHA1 hash:
2e1c574cced0dad4facf88bf11998cdbe3354bbc
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/689a53ff-9c62-48c4-953e-4cb7f8b715c5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75238/

Comments