🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710
SHA3-384 hash: 5916496ec99b061f83a9ff842e80b36c21c10832f9e3cdfeda2a69c474d432f10afaedce55f83814fbd0f05f5f32e6d5
SHA1 hash: 4649bddf320e91755ed969bf058c481141dd964d
MD5 hash: 771621f490fbf4ca91e178a73dfdc2d7
humanhash: hawaii-helium-pasta-michigan
File name:02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710
Download: download sample
Signature TrickBot
Create hunting rule
File size:26'824 bytes
First seen:2021-08-12 17:49:11 UTC
Last seen:2021-08-12 19:00:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9c0432e1910a7f6b5d39ec1826872d5a (1 x TrickBot)
ssdeep 384:1dWWizxVb4MFzVeTDFNCPGmYeU6YzGutMLD7MXxyJV/H318HpXPmqD6oju9FB9Jj:1dEv4MtGm/fYzGVDGAv18JX+qtjGHGO
TLSH T1BDC2AF569012E69ACAFC84F117D0503AAC06E790FF1893F571EFEBD5D9097857DE2480
Reporter Anonymous
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710
Verdict:
No threats detected
Analysis date:
2021-08-12 17:56:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d67ab5d2-20b1-462a-91d5-3dfde321a31f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrickbotModule
Create hunting rule
Link:
https://www.capesandbox.com/analysis/178793/
Detection(s):
SecuriteInfo.com.MALW_trickbot_bankBot.26197.29518.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3db7b994-b1d9-4049-8ed1-b5417ba70aec
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/832006
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: CobaltStrike Load by Rundll32
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 464437 Sample: uLY3WEggI8 Startdate: 12/08/2021 Architecture: WINDOWS Score: 72 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for submitted file 2->30 32 Sigma detected: CobaltStrike Load by Rundll32 2->32 34 2 other signatures 2->34 7 loaddll64.exe 1 2->7         started        process3 process4 9 iexplore.exe 1 76 7->9         started        11 cmd.exe 1 7->11         started        13 regsvr32.exe 7->13         started        15 6 other processes 7->15 process5 17 iexplore.exe 145 9->17         started        20 rundll32.exe 11->20         started        dnsIp6 22 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49772, 49773 YAHOO-DEBDE United Kingdom 17->22 24 geolocation.onetrust.com 104.20.184.68, 443, 49758, 49759 CLOUDFLARENETUS United States 17->24 26 9 other IPs or domains 17->26
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710/
Threat name:
Win64.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-08-12 16:44:30 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=al3yieib76qwjcqsmvq2o7mrrowc7gkoplh7joglotmdwwriw4ia._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210812-vzer23rcex/
Unpacked files
SH256 hash:
02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710
MD5 hash:
771621f490fbf4ca91e178a73dfdc2d7
SHA1 hash:
4649bddf320e91755ed969bf058c481141dd964d
Link:
https://www.unpac.me/results/28b314e9-9fb6-4c62-945d-24148662f247/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/02f7841101ffa1648a126561a77d918bac2f994e7acff4b8cb74d83b5a28b710

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_TrickbotModule
Create hunting rule
Author:ditekshen
Description:Detects Trickbot modules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/178793/

Comments