MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
SHA3-384 hash: 55f8461860067ebcc7a87905b213389bb4662ee1e982c8a8fdb9697da724fcb7d3c4402befc6a5dd0fcdecb3dd372ad7
SHA1 hash: e9def0ff07f062d5f0b4b629d73ce7de736c3d63
MD5 hash: 51417793657bde10a65ad3c4d8346880
humanhash: mexico-diet-wisconsin-wolfram
File name:e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
Download: download sample
Signature TrickBot
Create hunting rule
File size:132'096 bytes
First seen:2020-10-24 21:04:39 UTC
Last seen:2020-10-24 21:56:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:5n1CQlmzVJLYMgroJLsv6PSMNkHHCtR9sv:JEQlmzb0fpCPSM6OR9
Threatray 5 similar samples on MalwareBazaar
TLSH 11D34A0EEAD792F1FE8101F0166EA33F597153216B155AC3C7A01C61A9612F3A23E66E
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75244/
Detection(s):
SecuriteInfo.com.Trojan.Trick.46728.10649.7472.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Connection attempt
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/508757
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-19 07:36:35 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4n2drrujwn5kch3c6hngcwsubi62mhvypujeb2s5pqjnc7ddtopq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
TrickBot
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
TrickBot
e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
TrickBot
fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/201024-a8tt9m1yw2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Trickbot
Malware Config
C2 Extraction:
51.89.177.20:443
194.5.249.174:443
107.174.196.242:443
185.205.209.241:443
82.146.46.220:443
5.34.178.126:443
212.22.70.65:443
195.123.241.90:443
185.164.32.214:443
198.46.198.139:443
195.123.241.187:443
86.104.194.116:443
195.123.240.252:443
185.164.32.215:443
45.148.120.195:443
45.138.158.32:443
5.149.253.99:443
92.62.65.163:449
88.247.212.56:449
180.211.170.214:449
186.159.8.218:449
158.181.155.153:449
27.147.173.227:449
103.130.114.106:449
103.221.254.102:449
187.109.119.99:449
220.247.174.12:449
183.81.154.113:449
121.101.185.130:449
200.116.159.183:449
200.116.232.186:449
103.87.169.150:449
180.211.95.14:449
103.36.48.103:449
45.127.222.8:449
112.109.19.178:449
36.94.33.102:449
110.232.249.13:449
177.190.69.162:449
Unpacked files
SH256 hash:
e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
MD5 hash:
51417793657bde10a65ad3c4d8346880
SHA1 hash:
e9def0ff07f062d5f0b4b629d73ce7de736c3d63
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/50ca569a-75c4-4add-80b7-97196d305825/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75244/

Comments