MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
SHA3-384 hash: 5629413e9048254be766e2576e86857857f585b2b454471723d420030f52c206dc07fedcd9c1d3ce34096283ac49e5d7
SHA1 hash: 43ed5bdf1302713a824d8c11ba1f58d2e9858519
MD5 hash: b1013e27f36fe5a05228bc6c5b7d16e1
humanhash: edward-zulu-fillet-burger
File name:fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
Download: download sample
Signature TrickBot
Create hunting rule
File size:131'584 bytes
First seen:2020-10-24 21:04:57 UTC
Last seen:2020-10-24 21:56:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:a5uQ9QgBrsG7a/1Ig+0z0nii+gxIFr/OcyyXhi0p:toR17a9Ig+DiiAFDjyyX00
Threatray 5 similar samples on MalwareBazaar
TLSH C4D34A0EE6D7D2B4FE8500B0266EB33F5D754231AB1599C3C7905C20E9116F7A23E6AE
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75262/
Detection(s):
SecuriteInfo.com.Trojan.Trick.46729.9704.10828.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/508769
Signature
Antivirus / Scanner detection for submitted sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-19 03:52:03 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7kbismeczgjsgeu6t7i5rsmavqxj54t7kst56vks4y3hgl2wj3na._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
b00e7f74539cf39940c9044b6ac1d131a23c896c7905d71a087a01245232ada3
TrickBot
bc27bd1905991f35c3a125279ea0a20d7f723f80778ae6cc07b37179b2e1f83a
TrickBot
c92c8f661143ca66f2f5ffe619dd910918f85105de9a49db785261f80320e85c
TrickBot
e23d0a093ffa9acf3cae4925a4097d59fedcdab495e5a20e46ff5a5f9550a87d
TrickBot
e37438c689b37aa11f62f1da615a540a3da61eb87d1240ea5d7c12d17c639b9f
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/201024-5sk4wv5lxe/
Behaviour
Suspicious use of AdjustPrivilegeToken
Trickbot
Malware Config
C2 Extraction:
51.89.163.40:443
89.223.126.186:443
45.67.231.68:443
148.251.185.165:443
194.87.110.144:443
213.32.84.27:443
185.234.72.35:443
45.89.125.148:443
195.123.240.104:443
185.99.2.243:443
5.182.211.223:443
195.123.240.113:443
85.204.116.173:443
5.152.210.188:443
103.36.48.103:449
36.94.33.102:449
36.91.87.227:449
177.190.69.162:449
103.76.169.213:449
179.97.246.23:449
200.24.67.161:449
181.143.186.42:449
190.99.97.42:449
179.127.88.41:449
117.252.214.138:449
117.222.63.145:449
45.224.213.234:449
45.237.241.97:449
125.165.20.104:449
Unpacked files
SH256 hash:
fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda
MD5 hash:
b1013e27f36fe5a05228bc6c5b7d16e1
SHA1 hash:
43ed5bdf1302713a824d8c11ba1f58d2e9858519
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/a5ebd766-8e22-43f5-8c75-b9cbf171e25f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa82893082c99323129e9fd1d8c980ac2e9ef27f54a7df5552e636732f564eda

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75262/

Comments