MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9c50a3612fd09ffbcf2b31d87ebd1f2a2cbef36296badca64d59af3541d2253. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9c50a3612fd09ffbcf2b31d87ebd1f2a2cbef36296badca64d59af3541d2253
SHA3-384 hash: d90880b3e5a21fe2eda9e6431ea608e4fc8d53138c59aa80ba41ddea697e5d6ea6a71dcbd5a5fd9370d4ae5705934332
SHA1 hash: 6feeb5759cdb26ac6ee88554cb15661ee9a1e298
MD5 hash: 1ea3852e02e9b68044ed56b360d43483
humanhash: bluebird-pip-muppet-timing
File name:90EYJSFYHMS.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:765'954 bytes
First seen:2020-05-05 15:59:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 30625d671f2d3abf2a3e2df54581f47b (312 x TrickBot)
ssdeep 12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwyO:grdO+tDKFQoNOml/
Threatray 357 similar samples on MalwareBazaar
TLSH 0DF4B32F8EBC4E13E5D4C2F03E368E5CA6D65C19F84C65AE53043E8A2E637322D5456E
Reporter JoulK
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.20ee34e01ac25807.25233.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 01:14:23 UTC
File Type:
PE (Exe)
Extracted files:
31
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7hcqunqs7ue77phswmoyp26r6krmx3zwffv23ste2wnpgva5ejjq._file
Verdict:
unknown
Similar samples:
09f99e87519253aac7f690ea1e2769869a0c9f26bf35cada6ed703b84685388f
TrickBot
1061ec89b5ba14eb88f514006fa49d33217e711d6e3440b6c0811ee990aaff4e
TrickBot
2749fff54e114359892ac15d25415960876f1332ea7fc2f421fe2d92a016f42b
TrickBot
56c86fafed89b1d12c8c57cfc5e664824b2b5ae86ae4e8102fb98047eeb1308b
TrickBot
799888078bf038a69c829f68cdc58c558468fc8cefa9c2a4a6c435f153f61822
TrickBot
8841e0eb68db1a9ec6f808b943c24751a0746caa9fc78b37337e84b0b6b7abe9
TrickBot
97e67dc5db2aa27285c6ad52a8179a7d09b18688a88c463c65441d668c54334f
TrickBot
a0f068ea09ea33fbe3a0e7aca0f9c9fcb095bc2665b52ed51ba25e70b411c428
TrickBot
b86041236bb9055d5439e8118a90d255e9ec8da338c09caacc9a35195001acaf
TrickBot
e191fc96509f4b41f3f6a061de83bcf4a110b6b3421dc2bd12e81ff649301650
TrickBot
+ 347 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:ono41 banker trojan
Link:
https://tria.ge/reports/201109-rhkh5kzdz2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe f9c50a3612fd09ffbcf2b31d87ebd1f2a2cbef36296badca64d59af3541d2253

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/358112/
  
Delivery method
Distributed via web download

Comments