MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a
SHA3-384 hash: d5c8f5efd425bbc0889f12e1c26881b78d7e147ad53fc9554d0305df88b56e3d6a2011b03e20b324b126ac30c2703d0f
SHA1 hash: 023666efe4c7ac08a8192a67516ae26edc4b2e38
MD5 hash: 74775e59d00746f145553f4159244c65
humanhash: asparagus-mars-washington-johnny
File name:74775e59d00746f145553f4159244c65.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:352'768 bytes
First seen:2021-02-15 20:17:04 UTC
Last seen:2021-02-15 21:49:36 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ee693e3bb4d5864fb5995225a53cea3c (3 x TrickBot)
ssdeep 6144:UEs72CZp1HKqFV+ScJRtHELfWuwDxMuPxE/W3HjD3X1:iRphKqnOJRtHELJwVMuSo/1
TLSH 81745B10F175022DEBA90773286CBEC2993C66C93E9DC75F766D19CE4629933B007A93
Reporter abuse_ch
Tags:dll mon55 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117246/
Detection(s):
SecuriteInfo.com.Generic.mg.74775e59d00746f1.23810.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/608421
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 353242 Sample: RI51uAIUyL.dll Startdate: 15/02/2021 Architecture: WINDOWS Score: 52 25 Multi AV Scanner detection for submitted file 2->25 27 Machine Learning detection for sample 2->27 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 regsvr32.exe 8->12         started        process5 14 iexplore.exe 1 74 10->14         started        process6 16 iexplore.exe 155 14->16         started        dnsIp7 19 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49765, 49766 YAHOO-DEBDE United Kingdom 16->19 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49759, 49760 FASTLYUS United States 16->21 23 10 other IPs or domains 16->23
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 20:18:06 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hif7g2cbvihuldxwgebyj2mpfruj6kucdpulxzsp7kvr7o5tdb5a._file
Verdict:
unknown
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon55 banker trojan
Link:
https://tria.ge/reports/210215-z5rynp8vgj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
Unpacked files
SH256 hash:
ebd0a930e9b27e94e50e65efd51ab69bc2a3fece46818385cc065580938608d3
MD5 hash:
ff197a2a73e4361c5c1efa21c491aa77
SHA1 hash:
9c2c3624597591803e310ae70a7705faecc927f0
Link:
https://www.unpac.me/results/7673abf3-7c29-4d94-b1dc-3a4f6e5f1f86/
SH256 hash:
7de40a3b9a8143c5ac0f7dd4ed21117351d1bf0cd47865c91de4eeafb579db1d
MD5 hash:
85e491e18501f520ce93704e3fbcfdea
SHA1 hash:
625b3ac9afe183908d2003529e3fa0062a10bc1d
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7673abf3-7c29-4d94-b1dc-3a4f6e5f1f86/
Parent samples :
3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a
be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7
SH256 hash:
3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a
MD5 hash:
74775e59d00746f145553f4159244c65
SHA1 hash:
023666efe4c7ac08a8192a67516ae26edc4b2e38
Link:
https://www.unpac.me/results/7673abf3-7c29-4d94-b1dc-3a4f6e5f1f86/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1011572/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117246/

Comments