MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991
SHA3-384 hash: d00bf5eb2e838add43eabd6abfda3be20ff573110ada1fc64e54c3d70edace0a2a93506d18a4848f05bab919e1a6f108
SHA1 hash: 1f07b147da7d6a01979652aaefe6fd60a01af0d2
MD5 hash: a4193551194e8ca981319f06cd2231d2
humanhash: colorado-east-asparagus-emma
File name:boom5.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:344'064 bytes
First seen:2021-01-22 18:02:37 UTC
Last seen:2021-01-22 20:02:00 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash bb7c065f667d4cb5d5fc794cd3764357 (3 x TrickBot)
ssdeep 6144:uxRzpqLYyuKMD8IekSB6h1z0BmdxXK7jZ6N7zkZpGKn:uGd6D60WoXKv84LGKn
Threatray 3'090 similar samples on MalwareBazaar
TLSH 8D749B10664C9021E3485B30954EFBE0495A5DF95BE4E38FEA797E3E7A321936A3310F
Reporter James_inthe_box
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/113547/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.72137.3869.25296.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a UDP request
Sending a custom TCP request
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/588591
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 343317 Sample: boom5.dll Startdate: 22/01/2021 Architecture: WINDOWS Score: 48 27 Multi AV Scanner detection for submitted file 2->27 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 regsvr32.exe 8->12         started        process5 14 iexplore.exe 2 71 10->14         started        16 wermgr.exe 12->16         started        process6 18 iexplore.exe 142 14->18         started        dnsIp7 21 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49747, 49749 YAHOO-DEBDE United Kingdom 18->21 23 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49744, 49745 FASTLYUS United States 18->23 25 9 other IPs or domains 18->25
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991/
Threat name:
Win32.Trojan.EmotetCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-01-22 18:02:28 UTC
File Type:
PE (Dll)
Extracted files:
33
AV detection:
23 of 46 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hq2hnx7pxxdr5fxxg7ayk4ipkrpdysqvokdzyx4iqzjqc7agrgiq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
02a31022e1e829f4d6f854ad5c8c03fd0350dfb5b1f74b585dcf419711e185d4
TrickBot
3a214b848b9d317e2c8dfdc7a2e55ee7893b6e4aadc335992d3425480c7eb8b6
TrickBot
51c2e947522399b8074d5862d8d32257264ae8e39f1d07923085e7b96821109f
TrickBot
7d974d5a314a19adf76cdd29618acbfb6a61d1cbbdf150ca1c62b88cda9e79dc
TrickBot
89ba36ddab48b3cdd3a8db026463e79391c6ca7f0b04a9ea8b71969add67b276
TrickBot
c98b7b275bf404b2e20641f7802e686e8a64b7aa72e1ec0152cf03667daea2be
TrickBot
ed8dea5381a7f6c78108a04344dc73d5669690b7ecfe6e44b2c61687a2306785
TrickBot
f4f92a6ed4e8a88818db25823c89833364e1b4699588a631696262daa3212aee
TrickBot
f57ec5263ab7f3191cfd364dd364e694f93769b691514d3a2e39e6812471e80e
TrickBot
f61b83f5c8c63c2074e9445599ab9dacba8ff58ddb594f434157c6deda73d317
TrickBot
+ 3'080 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:boom5 banker trojan
Link:
https://tria.ge/reports/210122-2crthmaw2s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
Unpacked files
SH256 hash:
59bab20769f7517434223caa5bc92d0f9eab53fa65a058c069bd73e7f03a2ca2
MD5 hash:
1463be40ab61cf8ca8b65b509b01c149
SHA1 hash:
af1d51dc9f3ca85a48108e357bffe009068bd2a9
Link:
https://www.unpac.me/results/41182e09-27c3-4062-9570-696b10c32055/
SH256 hash:
a8c6b215a2c3480f700e85765a5e5582b54f0bd4295aa07c6189ddb91597f0c9
MD5 hash:
3d2cf0771b20b67ac125b8ba19afa750
SHA1 hash:
5ec9684b4590dbf7ec742abbf0055a56d4f644cd
Link:
https://www.unpac.me/results/41182e09-27c3-4062-9570-696b10c32055/
SH256 hash:
08d6ff881863161b4c7f43799ae286a5df0db71945503b22419c622f201351e2
MD5 hash:
94fb75950a62651486c9d2daf93e6999
SHA1 hash:
1bc20ba2c9e708defcffa26f54967efb4e322c97
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/41182e09-27c3-4062-9570-696b10c32055/
SH256 hash:
3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991
MD5 hash:
a4193551194e8ca981319f06cd2231d2
SHA1 hash:
1f07b147da7d6a01979652aaefe6fd60a01af0d2
Link:
https://www.unpac.me/results/41182e09-27c3-4062-9570-696b10c32055/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3c3476dfefbdc71e96f737c185710f545e3c4a1572879c5f888653017c068991

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/113547/

Comments