MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af745b89b72c57307c1805107ea440b0c5768057de52ed3aff6a1c675514ab85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af745b89b72c57307c1805107ea440b0c5768057de52ed3aff6a1c675514ab85
SHA3-384 hash: 7cecf710c25382d711d33a30b88e89a4ae62aa90ec141c548e47a61093c4178e12c9d387ad762fcb0e03717f223eca51
SHA1 hash: 533c8cfc408d58344e98ed983b046320047487ba
MD5 hash: 74587524b1e65c3e0e138d08f206d5fc
humanhash: william-hawaii-enemy-maine
File name:may.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:343'040 bytes
First seen:2020-06-10 17:42:52 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash eaa160f1e1efafd41fdc453248b72d54 (1 x TrickBot)
ssdeep 6144:/GykthTuN7GARE2/72QotgKrTwBlwqiPL8N160na0cpluPXMS/BsG+DfD5GuozeR:v4/1sgp8uQs3fqcUDiCveqpGN
Threatray 4'944 similar samples on MalwareBazaar
TLSH 9474DF02778D9430F0EEE6371CA1D6F2036DF521C4A49EABEB94891E5B346E0CDA571B
Reporter abuse_ch
Tags:dll geo TrickBot USA


Avatar
abuse_ch
Malspam distributing TrickBot malware:

HELO: copsbiau.monster
Sending IP: 89.203.248.175
From: State ministry <pack@copsbiau.monster>
Subject: Speak out anon about Black Lives Matter
Attachment: e-vote_form_8748.doc

TrickBot payload URLs:
https://ppid.indramayukab.go.id/may.php
https://www.inspeclabeling.com/wp-content/themes/processing/may.ph

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 17:44:07 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v52fxcnxfrlta7ayauih5jcawdcxnacx3zjo2ox7niogoviuvocq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
13d5829ecced67bca7295591da922eba16055f0b35279593589f7a65fa9d65a4
TrickBot
1455554d5585f68ec7212a6fca985aa7e3bb1904fce6dcfbb9a0b26751cbd23e
TrickBot
198d4693da2e3446cc93298b2535eb07b43a74b44c000b3c99d8d4e2053d3011
TrickBot
5b53e93d56e20740ef468c0dc16bf4b0dc459007637874f1b2e8094f7d41e0a2
TrickBot
5c1df1958b639f2a2fac01fc28190ac4672facd0fe523efdedf2b2a24424d409
TrickBot
8af7651e5c9bbc5e999a745ed4747d9e9e54fb425f824c7438ac07a00f834612
TrickBot
95219d7277efae8024c40d481e120b7c70f8c73f361574752c62ffe789346c3e
TrickBot
a97d416fd7fc1f37199012e44f1d6b1946b59f7d6b92b89d38dbee74a18c7554
TrickBot
ea78f793d2de0b9b6da1ddd8530de9c646f3bbaa115f0cbcd7339ddfb5c3b0f7
TrickBot
f6e6dd99805f5762245b3730297962b52fe32370ed6a60ddf8b7b661cc881764
TrickBot
+ 4'934 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:gi6 banker spyware trojan
Link:
https://tria.ge/reports/201109-pqzjtjgljx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Word file doc af3fcc4d0646a3a2c27512b07a0c84428ced10606e28e248ecfcd8c2569d85d8

TrickBot

DLL dll af745b89b72c57307c1805107ea440b0c5768057de52ed3aff6a1c675514ab85

(this sample)

  
X
https://twitter.com/abuse_ch/status/1270739166716989443
  
Dropped by
MD5 b2e6be2b7c08933f90d09b45a6144f85
  
Dropped by
SHA256 af3fcc4d0646a3a2c27512b07a0c84428ced10606e28e248ecfcd8c2569d85d8
  
Delivery method
Distributed via web download

Comments