MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918
SHA3-384 hash: ad393634b58ad5b4c1939413569cd01599c193931135a2453dc21977ab059a79814a310cf51680ff77b9458e13ddaf1f
SHA1 hash: a827a2e9e2072ae57420a22f469e7053de62ea97
MD5 hash: 1f5033d76b72ff259bf0d7ab33725141
humanhash: cold-seven-kansas-six
File name:1f5033d76b72ff259bf0d7ab33725141.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:716'800 bytes
First seen:2021-06-20 06:39:24 UTC
Last seen:2021-06-20 07:35:07 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 138b75389ce3822d86ad7f6cfbebc40d (2 x TrickBot)
ssdeep 12288:gtDlVPn5ZvJvxc3DmEAdLXcppE/XhtvWQqmEAdLXcppE/Xhtv:An5Z/E5kPhtvWQzE5kPhtv
Threatray 3'242 similar samples on MalwareBazaar
TLSH E8E4F11332E4C179D2AF06314E766B79BAB5BD509F70C6AB07D0DF5E4A31A408D2932E
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
303
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167137/
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.16161.868.16100.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ecae26f1-7e4a-422c-a9f7-62cc199db9a8
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/804855
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 437266 Sample: 676a7nw18N.dll Startdate: 20/06/2021 Architecture: WINDOWS Score: 48 30 Multi AV Scanner detection for submitted file 2->30 7 loaddll32.exe 1 2->7         started        process3 process4 9 iexplore.exe 2 83 7->9         started        11 regsvr32.exe 7->11         started        13 cmd.exe 1 7->13         started        15 2 other processes 7->15 process5 17 iexplore.exe 5 152 9->17         started        20 cmd.exe 11->20         started        22 rundll32.exe 13->22         started        dnsIp6 24 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49741, 49742 YAHOO-DEBDE United Kingdom 17->24 26 geolocation.onetrust.com 104.20.184.68, 443, 49724, 49725 CLOUDFLARENETUS United States 17->26 28 9 other IPs or domains 17->28
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-06-17 03:49:56 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ba2cj6jue6sh7z24sfg464ijcitl2wmkbtsrfxgnahfqwxkizema._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1e472b9de49871cbf3a381b560312a55163a196213329fdae34f4bbae6dd9d20
TrickBot
437d0b75f67c18c12a35d9c0e1a32fc57b426834fa4df63f30f11cb17dd24528
TrickBot
678de819abf5f00b28eaaa8239169a08a75050a4df26fe3ce5b262d6c7b6cb24
TrickBot
7500223b9a23a332ccb85b42ad8536250ba2cbd77ed8cf80c1b1a4ffe6876865
TrickBot
8366ec12a0a566dd36e60c387942b054865d2ee8d9aba3fd502b34068514bc64
TrickBot
87402c2ee3595cd862dbb82648aa9ebf17d41ceb05f912e50493d9ba96acb9a4
TrickBot
896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a
TrickBot
acb81dadb44ea5fac7a47aa1829865e765524bff935c74e2f31af97ed81b7479
TrickBot
f43c9ad36b819d692a9aea25d155847b3e098099aa97750f67bcc01c63ea7b55
TrickBot
fd3af0e7890546cc6e6ee828df5a31a4c88c587f968b0298a672b703bf71b7e4
TrickBot
+ 3'232 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon311 banker trojan
Link:
https://tria.ge/reports/210620-my3xhkwtcx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
178.72.192.20:443
103.124.145.98:443
45.5.152.39:443
114.7.240.222:443
85.248.1.126:443
94.183.237.101:443
146.196.121.219:443
89.37.1.2:443
94.142.179.77:443
177.221.39.161:443
85.175.171.246:443
103.12.160.164:443
180.178.106.50:443
94.142.179.179:443
46.209.140.220:443
123.231.149.122:443
123.231.149.123:443
182.160.116.190:443
131.0.112.122:443
116.0.6.110:443
103.101.104.229:443
88.150.240.129:443
103.242.104.68:443
Unpacked files
SH256 hash:
79a402e6103628ba21fcb7ccab2daadf64e5c68839b405ef9d8a799fa84dd286
MD5 hash:
a0f55c46b3050451256c3e43e0183c03
SHA1 hash:
c4d69a5b541c088ba9449930c0143741029dc0b1
Link:
https://www.unpac.me/results/d39e868c-a488-409f-8749-d8a44300d3f8/
SH256 hash:
5806e6c90529fa94d28e473a0609efa97a62b35ea71926c061bae9a365894871
MD5 hash:
9940e0f6e03e9f011a1f7d51ddc6c707
SHA1 hash:
649d6481d42447e717f43fa951550c2ac6e0c902
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d39e868c-a488-409f-8749-d8a44300d3f8/
Parent samples :
87402c2ee3595cd862dbb82648aa9ebf17d41ceb05f912e50493d9ba96acb9a4
083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918
SH256 hash:
be208603b7246dfb24a68cf163e342b6d2c2e4b7c2e909274c78e8d172a8a8af
MD5 hash:
b858e891b6775e754131150acb21b342
SHA1 hash:
5775455bd82f3dcfcae3fe5bb2473446ddffcbdf
Link:
https://www.unpac.me/results/d39e868c-a488-409f-8749-d8a44300d3f8/
SH256 hash:
d6252f3b0636e892251c8e46ad7f3b84c634e128d0eebd09272fb171ec359d44
MD5 hash:
b64e8f445fb37053648435e41fa18538
SHA1 hash:
0f415cdcd80acc9ce7559e09a2296352189ddaac
Link:
https://www.unpac.me/results/d39e868c-a488-409f-8749-d8a44300d3f8/
SH256 hash:
083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918
MD5 hash:
1f5033d76b72ff259bf0d7ab33725141
SHA1 hash:
a827a2e9e2072ae57420a22f469e7053de62ea97
Link:
https://www.unpac.me/results/d39e868c-a488-409f-8749-d8a44300d3f8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/083424f93427a47fe75c914dcf71091226bd598a0ce512dccd01cb0b5d48c918

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167137/

Comments