trickbot | d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80

Resubmissions

17/04/2026, 00:57

260417-bazevags8x10

15/04/2026, 01:17

15/04/2026, 01:12

15/04/2026, 00:51

30/03/2026, 07:17

Sharing

Copy URL Twitter E-mail

General

Target
24776324204.zip
Size 263KB
Sample260417-bazevags8x
SHA256 d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80
MD5 48e5a5a7b307c09de2e61ab4736f7005
SHA1 af8247f2e23b80e3a75924682b469f5da6ed7dfc
SHA512 bd08ae6e1ee1a8ec486fbe93dc520e80f97c37f74bcece72373c28caf70aeeaf4013aa5957e0973198a695039844f7d0c5aad3e4c1c92804f07e88728bc27b59
SSDEEP 6144:3nrjwgOa/NMpv/F9sQuckTRMai3Xh4lxef:3ga/KpnvMxTRli3yzw
TLSH
T1EA4423BBE1E895C9515D299C09595A24337DCF8049DD67F736EEC0FB28C3230392A867
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

trickbot

Version

1000210

Botnet

tot245

188.124.167.132:449
93.109.242.134:443
41.211.9.226:443
158.58.131.54:443
36.74.100.211:449
87.255.24.238:449
200.111.167.227:449
109.86.227.152:443
85.172.38.59:449
190.4.189.129:443
65.30.201.40:443
66.232.212.59:443
80.53.57.146:443
182.253.210.130:449
155.133.31.21:449
94.112.52.197:449
209.121.142.202:449
5.102.177.205:449
209.121.142.214:449
185.42.192.194:449
144.48.51.8:443
185.174.172.180:443
185.249.255.31:443
185.174.173.138:443
92.63.107.235:443
62.109.16.54:443
92.53.67.19:443
89.223.88.121:443

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll

ecc_pubkey.base64

Targets

- Target
  24776324204.zip
- Size 263KB
- SHA256 d12d1a5b02ead7232abfab2f443568e63c3ef00ceabd949e4d8567dffbcb1a80
- MD5 48e5a5a7b307c09de2e61ab4736f7005
- SHA1 af8247f2e23b80e3a75924682b469f5da6ed7dfc
- SHA512 bd08ae6e1ee1a8ec486fbe93dc520e80f97c37f74bcece72373c28caf70aeeaf4013aa5957e0973198a695039844f7d0c5aad3e4c1c92804f07e88728bc27b59
- SSDEEP 6144:3nrjwgOa/NMpv/F9sQuckTRMai3Xh4lxef:3ga/KpnvMxTRli3yzw
- TLSH
  T1EA4423BBE1E895C9515D299C09595A24337DCF8049DD67F736EEC0FB28C3230392A867
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1
- Target
  005ce041948cce1950e2888c100580851e10a50ad4ff0e534ea3884bfad2d7cd
- Size 328KB
- SHA256 005ce041948cce1950e2888c100580851e10a50ad4ff0e534ea3884bfad2d7cd
- MD5 fc4118afa84f8aea26419db2016cd2a8
- SHA1 f1fd7fbe02c07affa3a2f7df15d4c9747add2603
- SHA512 2d78cc76891ad44d7a294ebd4120bb2fcbc04824f807869d68b9f7b61cc60fdc90203a6dbcb1a6415be52d58e0dd4688e5d20e0dd5506a2c912236038481956c
- SSDEEP 6144:riEN2nK841d3pAg6SEyLlhFp0l94dLpuoo+Pt3LpFfsBvg5vdHL9:ri3J41HU4Gl9sxNZVR
- TLSH
  T16A64DF276DAE4063C210C4F1DBE590F66A28EC77F841543FA756BE292B70C831AE3576
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

banker tot245 discovery trickbot trojan
- Family: Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Family: Trickbot

Trickbot x86 loader

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2