MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5c1df1958b639f2a2fac01fc28190ac4672facd0fe523efdedf2b2a24424d409. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 9
| SHA256 hash: | 5c1df1958b639f2a2fac01fc28190ac4672facd0fe523efdedf2b2a24424d409 |
|---|---|
| SHA3-384 hash: | 9ef4275942c8cb4aa9b58c146664f20572c983c00c685f957b689e374d4c067151f3df14d1725ff14d7521acaa4e986f |
| SHA1 hash: | 7b5dba57f7a081234ec38abda016b32d6316e02b |
| MD5 hash: | 03e9151a3d9a64b536adaaa8a455d73d |
| humanhash: | leopard-maine-hawaii-potato |
| File name: | update.dll |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 280'576 bytes |
| First seen: | 2020-07-20 14:49:29 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | bd9ae4d9acfc94b704f6f20956751799 (2 x TrickBot) |
| ssdeep | 6144:+iSA0kBRgWsDuNTymeKDrLO9TQ4uj5W1CEi:+iSA0kBRBpLO5Qlc1CJ |
| Threatray | 2'085 similar samples on MalwareBazaar |
| TLSH | B854E00232D2E071E5AF463D48256F050B7EBCB2DBF1999B7B84161E6A342C0DF35B66 |
| Reporter |  abuse_ch |
| Tags: | chil72 dll GBR geo TrickBot |
abuse_ch
Malspam distributing TrickBot:HELO: mx-out.tlen.pl
Sending IP: 193.222.135.142
From: ernstpaginajpx@go2.pl <ernstpaginajpx@go2.pl>
Subject: Past due charge to Holmes Place
Attachment: Notification_91870.xls
TrickBot payload URL:
http://198.50.138.24/aGZSw2PkwAs9Hi.php
http://5.182.210.224/images/update.dll
Intelligence
File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Detection(s):
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Launching a process
Unauthorized injection to a system process
Result
Threat name:
Trickbot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Behaviour
Behavior Graph:
Detection:
trickbot
Threat name:
Win32.Trojan.TrickBot
Status:
Malicious
First seen:
2020-07-20 14:51:05 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
trickbot
emotet
Similar samples:
+ 2'075 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
xls Delivery method
Distributed via e-mail link
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.