MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b4e2eaa2c933d266ce048d25144e8a48e83c26de690d61b97edc665cdd3f3c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b4e2eaa2c933d266ce048d25144e8a48e83c26de690d61b97edc665cdd3f3c3
SHA3-384 hash: 1a78116781f148b763f1ff4ea0f493d0a7a874d2f09f79f0c55da5f5d5efcbc879e9dd479739e057c85bd63a4e352aee
SHA1 hash: 093cf0daa9da4509dfd5afd771058d7ff75b4f85
MD5 hash: 0a2b3e8f444d8e0ef4b9228c4c0ab39b
humanhash: golf-freddie-bluebird-winter
File name:may.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:397'824 bytes
First seen:2020-05-26 17:11:23 UTC
Last seen:2020-05-26 18:08:23 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 56f2f54bbbcdc4cc94227b1e21cbd34b (1 x TrickBot)
ssdeep 6144:gGne6ZiCj8iyEPQHMhLpyOQPwktAYP0u2Mlgh1b9dUKFtPbHb:gGne6ZFbPKqQ3AYMu25hTbb
Threatray 3'091 similar samples on MalwareBazaar
TLSH CD84DF01B691D070D4AF023A091ABB814B7EBC708F65579B77D5BBDE1EB42802E3578B
Reporter abuse_ch
Tags:exe TrickBot


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: server17.monster
Sending IP: 104.37.170.64
From: Genuine Parts Company <recruiter@server17.monster>
Subject: Fw: Fw: Re: Fw: Re: draft Invoice document charged
Attachment: Invoice file 9017.doc

Unknown payload URLs:
https://impactcenter.ro/catalog/view/theme/default/may.php?omz=b
http://gec.cosas.pe/wp-content/themes/cosas/may.php?omz=b

Intelligence

File Origin
# of uploads :
3
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

PUA.Win.Adware.Bang5mai-6804572-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 17:22:42 UTC
File Type:
PE (Dll)
Extracted files:
21
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
04d875e96b175c1b48bc73d256c4b5f473c189c4cde85be92cecab2e74e7dd2f
TrickBot
27c3f84dd3101c302afb523ee2c5b728c1fc34cfb8430c314d1f2df5ed79c28c
TrickBot
376c114e2072a289c3b38c6f96f41cbecdc7919142b1f6efe4f9f83e61810d5d
TrickBot
5c1df1958b639f2a2fac01fc28190ac4672facd0fe523efdedf2b2a24424d409
TrickBot
6738bf02f3fa9f972eb4a9e6b8a45bcf1bfc34d9b97e94d0bf37a398a6acd90d
TrickBot
9b391545739faad182793dcda22cd76ecac4cd4d796dbb69663e976c1df11c5e
TrickBot
aea1d064fb75706dd261f1097f91574050216410ce840e9c7523c46aca53c5f9
TrickBot
d445ce07d829eee3f7fc6a9e155e3b8f2fa90f9d5badaac60ef2a989efc9ad2a
TrickBot
e94e31beaf1c2a6c24f0973a621c8715faf91a18e8c7acdab8a832021c7ce5f5
TrickBot
f867450741303e1776e4144cbc93b014251801bfd37d15de95d1992576346ba9
TrickBot
+ 3'081 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:gi5 banker spyware trojan
Link:
https://tria.ge/reports/201109-dbcwl2xcve/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Word file doc 367f139e8c8861249b4250aa9687f631564dad947c3780f88c5d0853f12cb682

TrickBot

DLL dll 3b4e2eaa2c933d266ce048d25144e8a48e83c26de690d61b97edc665cdd3f3c3

(this sample)

  
X
https://twitter.com/abuse_ch/status/1265317629268557827
  
Dropped by
MD5 07b56475ffdf93110826d604e293173c
  
Dropped by
SHA256 367f139e8c8861249b4250aa9687f631564dad947c3780f88c5d0853f12cb682
  
Delivery method
Distributed via web download

Comments