MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ddda4ee9691dfb9cbe912930047586403e50d7e20ec9e7695fbdd84697d8a3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 2


Intelligence 2 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ddda4ee9691dfb9cbe912930047586403e50d7e20ec9e7695fbdd84697d8a3f
SHA3-384 hash: cc610140b1c00ba241741ccba31ed320e143a1415dc2316b64563dd8bf81cb612bc7edb80f12c576ebff0f28b21b7ede
SHA1 hash: 7cd4c7a81b57af0321ef0f00e2e0558a1d035eaf
MD5 hash: fe977f2abc0138387a399dafb1521b7c
humanhash: minnesota-table-pluto-music
File name:FLMA-instr.doc
Download: download sample
Signature TrickBot
Create hunting rule
File size:216'527 bytes
First seen:2020-05-22 06:50:06 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 3072:htcEFNP+3lyNKCWfIC/qbUNxtYZ2FicUAfd4u272emq05MrigOhPgB5BeY8+zkFw:PLHP5KCWfIsqwNHYZsCyrAmGKRyRr5Dh
TLSH 1924121C6100F885CB4B263D6204A8E0E75C99427E8AE60D317BBF5679CE0661A3DF7E
Reporter abuse_ch
Tags:COVID-19 doc geo TrickBot USA


Avatar
abuse_ch
Malspam distributing TrickBot:

HELO: covid-agency.space
Sending IP: 194.58.47.198
From: Weiner Helga <Margo@covid-agency.space>
Reply-To: Weiner Helga <Margo@covid-agency.space>
Subject: This is a new Employee Request Form under the Family and Medical Leave of Act (FMLA)
Attachment: FLMA-instr.doc

TrickBot payload URL:
https://autismlebanon.org/lkjh988jlk.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.DOCXRSTRGOOD.WIN32_PROCESS.200408.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WINMGMTS
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.WIN32_PROCESS.200402.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HEUR.VBA.CG.1.23843.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.HEUR.VBA.CG.1.15433.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-Word.Downloader.Obfuse
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 23:17:58 UTC
File Type:
Document
Extracted files:
29
AV detection:
14 of 30 (46.67%)
Threat level:
  2/5
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-eyj9gc7zwn/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Office loads VBA resources, possible macro or embedded object present
Drops file in Windows directory
Drops file in System32 directory
Loads dropped DLL
Blacklisted process makes network request
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://autismlebanon.org/lkjh988jlk.exe
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Word file doc 7ddda4ee9691dfb9cbe912930047586403e50d7e20ec9e7695fbdd84697d8a3f

(this sample)

TrickBot

Executable exe eeff6ccf798f62c083d9ffb79d3807433c39cc153e85db8bab498d0c688af078

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eeff6ccf798f62c083d9ffb79d3807433c39cc153e85db8bab498d0c688af078
  
Dropping
MD5 d55fe9b7f4d6a8ebdfdb7614c06bf17c

Comments


Avatar
Joul Kouchakji commented on 2020-05-22 11:47:46 UTC

C2 Config:
--------------
<dpost>
<handler>http://203.176.135.102:8082</handler>
<handler>http://112.78.164.34:8082</handler>
<handler>http://103.94.122.254:8082</handler>
<handler>http://170.238.117.187:8082</handler>
<handler>http://190.100.16.210:8082</handler>
<handler>http://190.119.180.226:8082</handler>
<handler>http://96.9.77.142:80</handler>
<handler>http://96.9.73.73:80</handler>
<handler>http://36.89.106.69:80</handler>
<handler>http://177.74.232.124:80</handler>
<handler>http://103.84.238.3:80</handler>
<handler>http://85.204.116.155:443</handler>
<handler>http://31.131.26.3:443</handler>
<handler>http://5.182.211.138:443</handler>
<handler>http://85.204.116.188:443</handler>
<handler>http://85.204.116.190:443</handler>
<handler>http://93.189.47.95:443</handler>
<handler>http://185.142.99.25:443</handler>
<handler>http://91.200.100.173:443</handler>
<handler>http://51.89.177.10:443</handler>
<handler>http://23.239.84.142:443</handler>
<handler>http://194.5.250.36:443</handler>
<handler>http://185.14.28.132:443</handler>
<handler>http://192.210.226.12:443</handler>
<handler>http://144.91.69.191:443</handler>
<handler>http://31.131.20.23:443</handler>
</dpost>