MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3611be7ee60f1adb4a14f2d5d307d7375fb8a9013d0ae24af5e639bcc524a595. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3611be7ee60f1adb4a14f2d5d307d7375fb8a9013d0ae24af5e639bcc524a595
SHA3-384 hash: 8cff8299cc1279eb681f93ecc15a2b57f28fee0182a9c113f0546942b540a81d3d19594bbb68695ff3ee4396862dff03
SHA1 hash: 8696b328a0b7c630848ffadd8d5bffa8ad476c84
MD5 hash: 2339e18e251bd2a064cf357761f3dd20
humanhash: south-fourteen-spaghetti-five
File name:CHIL65GHFR.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:369'152 bytes
First seen:2020-07-12 17:56:11 UTC
Last seen:2020-07-12 18:54:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 388594e6d5ae9169f039ac78c7f53f26 (3 x TrickBot)
ssdeep 6144:WioXvi2GXUvNuqxykGzvvE+8LuV+40wJxn+/Uh1vuBdZaGRN6pD5VLEa07Do:WioqnUvNtxy9zvs+PM40Ux+/UPvuBdZh
Threatray 1'842 similar samples on MalwareBazaar
TLSH B4742345CC8C81DEF9D028B5415AD4FCA311EA8B5EE6631D3849C6DF87B6DE1A8B3243
Reporter TrappmanRhett
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24907/
Detection(s):
PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-6
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Unauthorized injection to a system process
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3611be7ee60f1adb4a14f2d5d307d7375fb8a9013d0ae24af5e639bcc524a595/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-07-12 17:58:05 UTC
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
0517dfcbbc548c75f81cc8f64095ea39924d002a39e5cb4f7316b1984da5012d
TrickBot
082a9fe0d0d8dbde7944b9ce08b89e7dd1f0bd0d48d4bb11c92b5dbbc50a12b8
TrickBot
39b89f87fb5a6303bf6721c477e0c109a7cd67433081092fef963b26a00f28c9
TrickBot
43ca06c20a1d645beff33a1f034257f2db67b02066465fc5c72dfa69a27e6118
TrickBot
67a402b5426a99f38e38a45bb44edebcf44032ff39ca38178b7d42b6934fefa4
TrickBot
7fb688f33ebc7b9c193aa87c8638f78e93511354a187822e7d06c1668f30da82
TrickBot
8423fefddbb9197ebe12a5e51fb8f06e6dc2c02d6ef68b254faba0d6a63866c5
TrickBot
a459ec02bedc31bb265ba6e61e8a0cb1529e935215dfcc038c9450e142329931
TrickBot
a97d416fd7fc1f37199012e44f1d6b1946b59f7d6b92b89d38dbee74a18c7554
TrickBot
b22dc5d5b64b027c3912d1cf9e890b4e7c007cee2e8b46cbbd4676758142d0fe
TrickBot
+ 1'832 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200712-rwv18sbwaa/
Behaviour
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

DLL dll 3611be7ee60f1adb4a14f2d5d307d7375fb8a9013d0ae24af5e639bcc524a595

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/24907/

Comments