MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 360bf54cf443450166ed5927ad05d37e93e3989af5d0460177b694277901e6ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 360bf54cf443450166ed5927ad05d37e93e3989af5d0460177b694277901e6ad
SHA3-384 hash: cbd0d45ebbbff52da515d95a7af3a9b4fd842f9f6affe96c9403e94292a4b6941d2a2c212cf14fb9a6d3da9becd93c22
SHA1 hash: 922d87a2cfe03ab3260876041b67f1b669109947
MD5 hash: 9f7627f363448c7ea91c38db2e0b01a6
humanhash: lemon-virginia-bacon-failed
File name:Document_xxx.zip
Download: download sample
Signature TrickBot
Create hunting rule
File size:22'178 bytes
First seen:2020-12-28 17:21:20 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:8CBwvqAK5FVJi1qYABzMJ13LCS+CJj8SiRnI+63A5XJXgxCvxNPan4TyKaLPAdFL:8CBwvanVJrhMz3N9+wA5tiUTPcNKabAP
TLSH F4A2E0D7C11362A5E5FAA43C0C7BEE719C2DD67BE0B098318B5A4593DB150E00E7264B
Reporter abuse_ch
Tags:rob32 TrickBot zip


Avatar
abuse_ch
Malspam distributing TrickBot:

HELO: email.pioneeracademics.com
Sending IP: 212.146.220.138
From: Customer Service <techsupport@pioneeracademics.com>
Reply-To: Customer Service <admissions1@pioneeracademics.com>
Subject: Staffing Update xxx xxx
Attachment: Document_xxx.zip (contains "Document_xxx.xlsm")

TrickBot payload URL:
http://vermapaints.com/pic.gif

TrickBot C2s:
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449

Intelligence

File Origin
# of uploads :
1
# of downloads :
681
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.OOXMLSheetRefPartyHaveYourSelfAMerryLittleXmas.20201224.UNOFFICIAL
Create hunting rule

Xls.Dropper.QbotDocu12020-9818439-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Macro Execution Coercion
Detected a document that appears to social engineer the user into activating embedded logic.
Autostarting Excel Macro Sheet
Excel contains Macrosheet logic that will trigger automatically upon document open.
Document With Minimal Content
Document contains less than 1 kilobyte of semantic information.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/360bf54cf443450166ed5927ad05d37e93e3989af5d0460177b694277901e6ad/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gyf7kthuincqczxnlet22botp2j6hge26xiemalxw2kco6ib42wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/360bf54cf443450166ed5927ad05d37e93e3989af5d0460177b694277901e6ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

zip 360bf54cf443450166ed5927ad05d37e93e3989af5d0460177b694277901e6ad

(this sample)

TrickBot

Excel file xlsm 6fb3d68ea64e29b3304a3885fb1ef3b3fffa27b2ce89ad40afcdda9572d8dcfe

  
URLhaus
https://urlhaus.abuse.ch/url/943782/
  
Dropping
MD5 bfbefd0c2003da4eaca02b8500f12cd5
  
Dropping
TrickBot
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6fb3d68ea64e29b3304a3885fb1ef3b3fffa27b2ce89ad40afcdda9572d8dcfe

Comments