MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6a4af73637cba42f841b3934c6057e39290ad53a3b669b783f0958556680b06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	f6a4af73637cba42f841b3934c6057e39290ad53a3b669b783f0958556680b06
SHA3-384 hash:	eaf7a2ad87e061a249550d086ef9bed66cb6b5b3e989fb7e92644f8a6599509950af035d7bc6c3e66d5e81e3afe91817
SHA1 hash:	574a1dbaf59ae229940b2259015466ce994d742c
MD5 hash:	a38c312063725e7d2e7966227ffbbde5
humanhash:	jersey-alabama-earth-friend
File name:	6171 - Copy (1481).js
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	161'004 bytes
First seen:	2021-08-17 13:42:41 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	3072:33eP3133URRJsiiEKk+RmyPdZAo702bSNyFZjgAD5dTiHLflsaooPptBchehiGv4:33eP39PR5dTirOaooBfEehiXVZ
TLSH	T1B0F392D473C0D05366CD1B93FF057EE9E07AA876A5C8A203869876DD24BE147C2B4EE4
Reporter	abuse_ch
Tags:	js rob123 TrickBot

abuse_ch

TrickBot payload URLs:
http://185.244.41.34/premier.php
http://89.41.182.90/images/plotterline.png

TrickBot C2s:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Intelligence

File Origin

# of uploads :

# of downloads :

382

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6a4af73637cba42f841b3934c6057e39290ad53a3b669b783f0958556680b06/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=62sk643dps5ef6cbwojuyycx4ojjblktuo3gtn4d6ckykvtibmda._file

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:rob123 banker trojan

Link:

https://tria.ge/reports/210817-6ktyhws3ge/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Looks up external IP address via web service

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Trickbot

Malware Config

C2 Extraction:

65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Dropper Extraction:

http://185.244.41.34/premier.php

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f6a4af73637c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link: