MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdc6779eaa7e758be865981597dd4a7bf4d8462e1940953fd0f929cc39f02d3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	fdc6779eaa7e758be865981597dd4a7bf4d8462e1940953fd0f929cc39f02d3e
SHA3-384 hash:	e8de67a13f5ce2595dc650f2c3df92f8602f198aa98a17dfdf19b70ea623110c07e192095940ae81ec89601254d2e4bc
SHA1 hash:	47e8a7ab6aee83e383eaa099aa807818dce613f5
MD5 hash:	7cbadd0a82a982bc2939976da47b5da6
humanhash:	wisconsin-lithium-quiet-black
File name:	155EYJSFYHMS.exe
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	766'038 bytes
First seen:	2020-05-05 16:48:29 UTC
Last seen:	2020-05-05 17:12:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	30625d671f2d3abf2a3e2df54581f47b (312 x TrickBot)
ssdeep	12288:xyP2Md2hn+tDKFtKwK5KLK6KYK5KlK3K1aoNl7Mv+lwVwy:grdO+tDKFQoNOml
Threatray	2'905 similar samples on MalwareBazaar
TLSH	B6F4B32F8EBC4E13E5D4C2F03E368E5CA6D65C19F84C65AE53043E8A2E637322D5456E
Reporter	JoulK
Tags:	exe TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Generic.mg.20ee34e01ac25807.25233.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-05 01:14:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 31 (90.32%)

Threat level:

2/5

Verdict:

malicious

Label(s):

trickbot

TrickBot

3b4b6643b53452dc519bad7b6657a1fff4fe2e914968c3b2f4557b90d3d52716

TrickBot

44c77f69650a57c8ff8027b620fa0471310e9ad2869195a99b3c4655fbeac098

TrickBot

56fcf10477f6ebe48381f3ba54362ccd5617efccfb937efe58ecd157b275850c

TrickBot

5aa9453494b215b664d892ae769475ba98095df3c3dd42880cd53e244f8310bc

TrickBot

5d74129eb70628d55e30eaf8a22fd44b803de677044e1014dcbecd0d69a7aa82

TrickBot

6dee5907e6d007cc2dc812b55861636e8f75cbf5dbdc3f08f0316309072ac6f0

TrickBot

893267a4670a60e81af9de4af3630306e9c76dd2493b3658232c880c562344fa

TrickBot

9485255eddb7e0aac3afa02b102066990d5df6a4a976a1b47c220a62b53184bf

TrickBot

a34a2e6ab11068bb67cd10f1bd46d9513003dabd081e4d384dab4229debcabc9

TrickBot

+ 2'895 additional samples on MalwareBazaar

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:ono41 banker trojan

Link:

https://tria.ge/reports/201109-c4rvzcnm3e/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Trickbot

Malware Config

C2 Extraction:

5.182.211.215:443
194.36.189.141:443
172.245.159.191:443
104.168.125.105:443
158.69.133.69:443
193.38.54.106:443
93.189.41.252:443
5.101.50.173:443
5.9.178.74:443
185.99.2.133:443
158.69.133.68:443
144.91.76.208:443
85.204.116.18:443
51.89.177.14:443
45.148.120.176:443
85.204.116.182:443
190.214.13.2:449
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
202.29.215.114:449
171.100.142.238:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
103.227.147.82:449
96.9.77.56:449
103.5.231.188:449
110.93.15.98:449
200.171.101.169:449

Please note that we are no longer able to provide a coverage score for Virus Total.