MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
SHA3-384 hash: db0ce3493fcc6a1ad7c44495473fb595137d9ef734130a727b14e2fc7d7ba474956fedef3133a65f03b9968bf48f0c96
SHA1 hash: 285229d0b36440af66ebeef9f14bfa2f1be476b8
MD5 hash: 34f19a097d7799afab80ff9d723cc552
humanhash: eighteen-apart-ink-robin
File name:In-zoomConference.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:462'120 bytes
First seen:2021-09-20 15:54:18 UTC
Last seen:2021-09-20 17:00:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c6fd1f5475c1e8637450d5d63d96045d (1 x TrickBot)
ssdeep 12288:2uAj1uOciEhM47oVoJCo4afenIMTG9+pPolzZ/2aI/:wJuOzsM2goJD4afen1T0jlzpm
Threatray 1'073 similar samples on MalwareBazaar
TLSH T130A4E134758098B1E93F467BCDA49DAC077AFA215F46ECCF5258A6870A633E1FD31809
Reporter pr0xylife
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://zoomdetails.members-only.online/
Verdict:
Malicious activity
Analysis date:
2021-09-20 15:37:14 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/687d010b-dd2a-4d67-bb76-766d3df94561

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/189518/
Detection(s):
SecuriteInfo.com.ML.PE-A.21599.20557.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/defe6300-2241-4e2f-8982-84cef0e442c5
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/854218
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-09-20 15:55:05 UTC
AV detection:
10 of 27 (37.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7uedxqw3ynbgumzov6db32qdyzek2bgloo5i6ckqjslqv6itjcma._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0dd6adc7f40fac5c8268853f41a248996fc4554f227bf6486e5261e506b0c876
TrickBot
2634add718388ef78f53bb550b64fc29266df01ea09c96823f0e47bc85260e40
TrickBot
39adc7e2ea2a22034a153bb7d5eaba75ac81a26ddb0407bab5108242d1878c44
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0
TrickBot
9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
TrickBot
b7da1ed4d4b5461005d4a9ec7e54c69bc4a86ba94571c0c61840987bf87af1ab
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
+ 1'063 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob132 banker trojan
Link:
https://tria.ge/reports/210920-tcsn7ahbhn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
bbbe2af827bce5f26ed8723f90b6ce7364de39f2fd7871fc188c657d72abb57e
MD5 hash:
afb12ecc95a9a6904f26b26d4d6b1776
SHA1 hash:
fe0b0f22ad89ae7f5440f277afbb940ad11e83c4
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f947e584-778f-4ca4-b792-028b1f762422/
Parent samples :
fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
83f374f57d674ac1abf87f968ba37237e5403bcae01ded47b7a912c4c5a58163
SH256 hash:
403903993a2f5675b490327a30db4e6df9875b29459c572a139fe18a2adf45ad
MD5 hash:
6689af69ac9e0dd2610fb3f81a94c40c
SHA1 hash:
efa8b2e251116a07b26486e2f8ae4acae88bc889
Link:
https://www.unpac.me/results/f947e584-778f-4ca4-b792-028b1f762422/
SH256 hash:
fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
MD5 hash:
34f19a097d7799afab80ff9d723cc552
SHA1 hash:
285229d0b36440af66ebeef9f14bfa2f1be476b8
Link:
https://www.unpac.me/results/f947e584-778f-4ca4-b792-028b1f762422/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.trickbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/189518/

Comments