MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2db9aba962314d68dd87dd2404ce6533cd28e5bbc2098c591fc23b018c3a3982. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 8

Maldoc score: 21

Intelligence 8 IOCs YARA 6 File information Comments

SHA256 hash:	2db9aba962314d68dd87dd2404ce6533cd28e5bbc2098c591fc23b018c3a3982
SHA3-384 hash:	544516bc5b5b931469b5344129266a746fbf608d44c641b67b7c36d9ae222948b50a9b73298627fc41da3c569a389992
SHA1 hash:	8a22f50fd65575975722cee6169f51e3e497b2e6
MD5 hash:	b0a053930116048ce5ba43eb505513ee
humanhash:	timing-enemy-orange-vegan
File name:	SecuriteInfo.com.Heur.29862.20151
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	174'435 bytes
First seen:	2021-04-21 23:41:32 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	3072:+qSjvSwFl+ITLdr8taIsLhFvyNBX9blmMaZ2MCGYme95KFXFvATN0Nb:3SjvSwF3TmazdFvyVbe2HG3QKRFoTN0
TLSH	900412644B912D2CD3670432E034248EFE18B4F6DA9536C9D584B6F26B86B63B74F1CC
Reporter	SecuriteInfoCom
Tags:	TrickBot

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 21

OLE dump

MalwareBazaar was able to identify 33 sections in this file using oledump:

Section ID	Section size	Section name
A1	1042 bytes	PROJECT
A2	506 bytes	PROJECTwm
A3	991 bytes	VBA/Sheet1
A4	991 bytes	VBA/Sheet2
A5	991 bytes	VBA/Sheet3
A6	991 bytes	VBA/Sheet4
A7	991 bytes	VBA/Sheet5
A8	1440 bytes	VBA/ThisWorkbook
A9	6579 bytes	VBA/_VBA_PROJECT
A10	3372 bytes	VBA/__SRP_0
A11	395 bytes	VBA/__SRP_1
A12	800 bytes	VBA/__SRP_2
A13	156 bytes	VBA/__SRP_3
A14	458 bytes	VBA/__SRP_4
A15	456 bytes	VBA/__SRP_5
A16	266 bytes	VBA/__SRP_6
A17	256 bytes	VBA/__SRP_7
A18	171 bytes	VBA/__SRP_8
A19	170 bytes	VBA/__SRP_9
A20	170 bytes	VBA/__SRP_a
A21	156 bytes	VBA/__SRP_b
A22	171 bytes	VBA/__SRP_c
A23	170 bytes	VBA/__SRP_d
A24	171 bytes	VBA/__SRP_e
A25	170 bytes	VBA/__SRP_f
A26	3338 bytes	VBA/casemate_tumatakuru
A27	1054 bytes	VBA/dir
A28	6422 bytes	VBA/equivalency_etherized
A29	1115 bytes	VBA/favoredness_amatorial
A30	1106 bytes	VBA/jovialnesses_faugh
A31	2720 bytes	VBA/sanatorium_armours
A32	1480 bytes	VBA/vegetives_cariere

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
Suspicious	Environ	May read system environment variables
Suspicious	Open	May open a file
Suspicious	Write	May write to a file (if combined with Open)
Suspicious	SaveToFile	May create a text file
Suspicious	Run	May run an executable file or a system command
Suspicious	CreateObject	May create an OLE object
Suspicious	Chr	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Xor	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

825

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Heur.29862.20151

Verdict:

Suspicious activity

Analysis date:

2021-04-22 00:15:47 UTC

Tags:

macros macros-on-open

Link:

https://app.any.run/tasks/d0e9fae7-0937-42b6-97b9-09dfc0f2a119

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Legit

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

True

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/143482/

Detection(s):

TwinWave.EvilDoc.EMOCROSelfRefDontUseJelly.202000929.UNOFFICIAL

TwinWave.EvilDoc.DridexLeaveTheDoorOpen.20210421.UNOFFICIAL

SecuriteInfo.com.Heur.7387.31346.UNOFFICIAL

SecuriteInfo.com.Heur.29862.20151.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Creating a file in the %AppData% directory

Sending a custom TCP request by exploiting the app vulnerability

Launching a process by exploiting the app vulnerability

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/2db9aba962314d68dd87dd2404ce6533cd28e5bbc2098c591fc23b018c3a3982/results/dashboard

Payload URLs

URL

File name

https://promocionessostenibles.es/wp-content/plugins/meta-box/css/jqueryui/EAMqn8EBm.php

sharedStrings.xml

Document image

Image:

Download PNG

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/691930

Signature

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document exploit detected (creates forbidden files)

Document exploit detected (process start blacklist hit)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2db9aba962314d68dd87dd2404ce6533cd28e5bbc2098c591fc23b018c3a3982/

Threat name:

Win32.Trojan.Phonzy

Status:

Malicious

First seen:

2021-04-22 00:11:24 UTC

AV detection:

7 of 46 (15.22%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fw42xklcgfgwrxmh3usajttfgpgsrzn3yieyywi7yi5qddb2hgba._file

Result

Malware family:

n/a

Score:

10/10

Tags:

macro

Link:

https://tria.ge/reports/210421-a324zz1npe/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Script User-Agent

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Process spawned unexpected child process

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2db9aba962314d68dd87dd2404ce6533cd28e5bbc2098c591fc23b018c3a3982

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_TrickBot_xlsm_20210324 Create hunting rule
Author:	abuse.ch
Description:	Detects TrickBot xlsm

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/143482/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample