MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f5b2a9d72565eee864ecd613e63882d5c12145dd71a85f44ca451cbea110ce18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 11
| SHA256 hash: | f5b2a9d72565eee864ecd613e63882d5c12145dd71a85f44ca451cbea110ce18 |
|---|---|
| SHA3-384 hash: | f6dccb4621903571dfff5d4477b8f8247f2dcd7057c8d1cc7001d84082a5cbde40fb783b8c42a3677437b7cb02ce97dc |
| SHA1 hash: | d903ed9cc476b50e21bfe6dcf392c589235ea075 |
| MD5 hash: | b14dd93fd45b731b228ee4715085cbc5 |
| humanhash: | magazine-shade-robert-florida |
| File name: | b14dd93fd45b731b228ee4715085cbc5 |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 507'904 bytes |
| First seen: | 2021-10-05 08:16:23 UTC |
| Last seen: | 2021-10-05 09:01:25 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e38afb91bac491f7825e4d9386ac015b (4 x TrickBot) |
| ssdeep | 12288:J1YWEJFGqCu7+K+1A8uKQfL/g8g54yXsJ/20V/YnOcy:J1YWEJFGqd7++bgNtsJ/5i5y |
| Threatray | 3'965 similar samples on MalwareBazaar |
| TLSH | T114B4F10277D584B3DA62643209EAA77AB774BD554A32CF87A354FF0CDC31240993B36A |
| File icon (PE): |  |
| dhash icon | 02505e151a0d0008 (5 x TrickBot) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe TrickBot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
238
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b14dd93fd45b731b228ee4715085cbc5
Verdict:
Suspicious activity
Analysis date:
2021-10-05 08:20:32 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware keylogger packed
Malware family:
TrickBot
Verdict:
Malicious
Result
Threat name:
TrickBot
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.Zenpak
Status:
Malicious
First seen:
2021-10-05 08:17:15 UTC
AV detection:
6 of 45 (13.33%)
Threat level:
5/5
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 3'955 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Score:
10/10
Tags:
family:trickbot botnet:lib158 banker trojan
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
5a9be4eaf09608265f1453327b6f5d3936061c1a5de7ea51b9dc05898d7134fb
MD5 hash:
6133558624bb2cba20f13bff119d8329
SHA1 hash:
a650f5f7c81fe831830b0638ee899aa7ba0d4cf2
SH256 hash:
54c7beba95c3e2faed426b0f0ef2a40db8dc525b1b09faa70d6c445a3bbd0c4d
MD5 hash:
e734d9cb9b35de8e5487522fcc4de04f
SHA1 hash:
75c1c4b668c09727959cb227654dcc41e9904ea8
Detections:
win_trickbot_auto
SH256 hash:
1a8ebe5819afa0462047bfde05715cec279a6a6bdf28323edc12f82bf3982548
MD5 hash:
ecba0b2635ef500288d868912196f86c
SHA1 hash:
730f00f6252179fa05704906ba5cba782c7d8c26
SH256 hash:
f5b2a9d72565eee864ecd613e63882d5c12145dd71a85f44ca451cbea110ce18
MD5 hash:
b14dd93fd45b731b228ee4715085cbc5
SHA1 hash:
d903ed9cc476b50e21bfe6dcf392c589235ea075
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | win_trickbot_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.trickbot. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://51.195.192.116/images/eflyairplane.png