🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6
SHA3-384 hash: d6441b6b4b3457ad30945eeffd769c525b855888e08a10bbf84da5ef2b57577a2cd2bafe1d7c9afe72c53f54b76bdecf
SHA1 hash: bd5806791f86cda3a36c1c030a0e6e5da380e0d5
MD5 hash: aeb08b0651bc8a13dcf5e5f6c0d482f8
humanhash: maine-jupiter-washington-fillet
File name:network64Dll.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:24'200 bytes
First seen:2023-11-12 14:02:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 516e12c64fd0a1d4eb25fccd60d4295e (1 x TrickBot)
ssdeep 384:9gNoyO3N8MPYmvRsnfdil5SyJ5b0lrEhj8JbTv6DUA86:9gNoyyY/fdEP0t0QTTB6
TLSH T100B2F61233F94450E2B686B9DEB3CA33DA7135C52839DA2F02A4C5592FF1612ED28F57
TrID 45.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.3% (.EXE) OS/2 Executable (generic) (2029/13)
18.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter themalwareguy
Tags:exe TrickBot


Avatar
themalwareguy
Trickbot Network Module

Intelligence

File Origin
# of uploads :
1
# of downloads :
874
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
trickbot_network_grabber.dll
Verdict:
No threats detected
Analysis date:
2021-08-03 20:44:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a2b58a6e-ba61-4b02-aa2c-926d95b71225

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Malware.Trickbot_module-6735723-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm bankbot control lolbin masquerade overlay trickbot
Link:
https://www.filescan.io/uploads/6550db17b50c955759223dfc/reports/4478f311-8e23-43e3-9727-a0264668cde9/overview
Verdict:
Malicious
Labled as:
Trojan.Trickster
Link:
https://www.hybrid-analysis.com/sample/0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c5ce75f4-344e-41c5-a890-be888a5c1059
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1341355
Signature
Antivirus / Scanner detection for submitted sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1341355 Sample: network64Dll.dll.exe Startdate: 12/11/2023 Architecture: WINDOWS Score: 64 27 Malicious sample detected (through community Yara rule) 2->27 29 Antivirus / Scanner detection for submitted sample 2->29 31 Multi AV Scanner detection for submitted file 2->31 7 loaddll64.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        11 rundll32.exe 7->11         started        13 rundll32.exe 7->13         started        15 6 other processes 7->15 process5 17 WerFault.exe 16 9->17         started        19 WerFault.exe 16 11->19         started        21 WerFault.exe 16 13->21         started        23 WerFault.exe 20 16 15->23         started        25 rundll32.exe 15->25         started       
Score:
18%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6/
Threat name:
Win64.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2018-04-03 09:06:00 UTC
File Type:
PE+ (Dll)
AV detection:
31 of 38 (81.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bx2ynkqdgtol4bd5ethilhia4u373npazjayq3nle5dzw36gdota._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/231112-rcnzwsgd4t/
Unpacked files
SH256 hash:
0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6
MD5 hash:
aeb08b0651bc8a13dcf5e5f6c0d482f8
SHA1 hash:
bd5806791f86cda3a36c1c030a0e6e5da380e0d5
Detections:
win_trickbot_g3
Create hunting rule
Link:
https://www.unpac.me/results/ccfc0b94-9eb2-4ca8-a06f-869abf527e1f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_TrickbotModule
Create hunting rule
Author:ditekshen
Description:Detects Trickbot modules
Rule name:Windows_Trojan_Trickbot_91516cf4
Create hunting rule
Author:Elastic Security
Description:Generic signature used to identify Trickbot module usage
Rule name:Windows_Trojan_Trickbot_dcf25dde
Create hunting rule
Author:Elastic Security
Description:Targets networkDll64.dll module containing functionality to gather network and system information

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
  
Dropping
Trickbot
  
Delivery method
Other

Comments