TrickBot[.]7z | Triage™

Resubmissions

12/10/2026, 23:36

261012-3lp44aszbw

12/10/2026, 23:30

261012-3hda5afc527

Sharing

Copy URL Twitter E-mail

General

Target
TrickBot.7z
Size 44KB
Sample261012-3hda5afc52
SHA256 bc65b98c3fc6834aa40874ecea2463cb5ce5894635a694d83ff6f0f23cb8cae7
MD5 eeb34a1c420111d29eb279f7eac852bb
SHA1 beb8211f2af40e91564ab8f47d8a41cdbc35f100
SHA512 eb0ed324c1fd1c9dcc6b5d0c7e67abca1d942593ab767d58ecc5f4ac241bcdd7f9c486368a1cb7b5506daf154afdbfd6ad5df8e78129e7ce33111cf8cdac983b
SSDEEP 768:mfkQQtzxdwGvHFxPC49mBRyP4pHDYn5i8tfl0lDZqTJZT0VuoYTpHFGJZ21CAbVI:kkQQt5wu4pH8tNuZqlqQ5Zp5i4m
TLSH
T1FF23011FC56B7EB9674D1A9320785201420DAB8CFFA42E2514EA2D081377B8D85FE5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d

File Explorer

TrickBot.7z

.7z 44KB
3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d

.exe 192KB

TrickBot.7z

SHA256 bc65b98c3fc6834aa40874ecea2463cb5ce5894635a694d83ff6f0f23cb8cae7
MD5 eeb34a1c420111d29eb279f7eac852bb
SHA1 beb8211f2af40e91564ab8f47d8a41cdbc35f100
SHA512 eb0ed324c1fd1c9dcc6b5d0c7e67abca1d942593ab767d58ecc5f4ac241bcdd7f9c486368a1cb7b5506daf154afdbfd6ad5df8e78129e7ce33111cf8cdac983b
SSDEEP 768:mfkQQtzxdwGvHFxPC49mBRyP4pHDYn5i8tfl0lDZqTJZT0VuoYTpHFGJZ21CAbVI:kkQQt5wu4pH8tNuZqlqQ5Zp5i4m
TLSH
T1FF23011FC56B7EB9674D1A9320785201420DAB8CFFA42E2514EA2D081377B8D85FE5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d

IMPHASH ab7926589d5dfea5e9c26dbeedec8ebb
SHA256 3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d
MD5 39bf48682793069ecca03d4eef46ecac
SHA1 edc0a959b659659717af06157407015771f68bf5
SHA512 7c98007283f55c1d4216c2033526920cec8896d7f4a1c7df50650a43bab9df7f4c3f6549241810213915a93fbe6e5c5d3eb1465b66bed092dd663fddcb6c2e2b
SSDEEP 3072:AKvTOrKzbLOVyiRBKXu79eIsunG1zgMl8UXrhQcgx/:AKHGyTw9eZuG1Fl8irfgx/
TLSH
T1C714D52AF31BD0F8DD2764B2650BE2E76DFC7F018810AD4DCF455C19B929D1B0A24A69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

7859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CryptAcquireContextW CryptGenRandom CryptReleaseContext EqualSid FreeSid GetTokenInformation LookupPrivilegeValueW OpenProcessToken RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CreateFileW CreateRemoteThread CreateToolhelp32Snapshot DeleteFileW ExitProcess FindResourceW GetCurrentProcess GetCurrentProcessId GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTime HeapAlloc HeapFree HeapReAlloc HeapSize IsWow64Process LoadResource LockResource MultiByteToWideChar OpenMutexW OpenProcess OutputDebugStringW Process32FirstW Process32NextW ReadFile ReadProcessMemory SetFileAttributesW SetFileTime SizeofResource Sleep SystemTimeToFileTime TerminateProcess VirtualAlloc VirtualAllocEx WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

_iob _vsnprintf _vsnwprintf fgetwc getc memset memcpy

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize

oleaut32

VariantClear

shell32

StrStrIW

shlwapi

StrCmpIW

ws2_32

FreeAddrInfoW GetAddrInfoW WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect ioctlsocket recv select send setsockopt shutdown socket

Name

.text

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

TrickBot.7z

3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d

advapi32

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

ws2_32

generic