MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d3f9ef35b78b4368a3e098c6f119bf3bf103840959c71b52fcd979e78f21993. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d3f9ef35b78b4368a3e098c6f119bf3bf103840959c71b52fcd979e78f21993
SHA3-384 hash: 14f6b4a0343b16f8e2992e245fa645e588f5bd4134f279102aafeb87a5fc73f8bdb55604aaf7d7fe9ab348d515f0eac3
SHA1 hash: 88ebe16315b7ae546882fa6a27b5a95ad200e2c0
MD5 hash: 0896adeee9ddd62a678707d7bf5980b5
humanhash: solar-coffee-bravo-venus
File name:794.js
Download: download sample
Signature TrickBot
Create hunting rule
File size:204'919 bytes
First seen:2021-08-16 17:06:32 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 6144:Qz0R+XaKtjKSch+udORint3JNdG7Fnzdu3:Qz0RS/taD3fQJnpm
TLSH T1761429D0A780D0035ACD1B53FF167EE9E13AE47265C4A147C6987B9C28B9857C2B8EF4
Reporter abuse_ch
Tags:js rob122 TrickBot


Avatar
abuse_ch
TrickBot payload URLs:
http://185.244.41.28/click.php

TrickBot C2s:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Intelligence

File Origin
# of uploads :
1
# of downloads :
427
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d3f9ef35b78b4368a3e098c6f119bf3bf103840959c71b52fcd979e78f21993/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hu7z5423pc2dncr6bggg6em36o7raocaswohdnjpzwlz46hsdgjq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210816-4xza4854qx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://185.244.41.28/click.php
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3d3f9ef35b78/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d3f9ef35b78b4368a3e098c6f119bf3bf103840959c71b52fcd979e78f21993

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Java Script (JS) js 3d3f9ef35b78b4368a3e098c6f119bf3bf103840959c71b52fcd979e78f21993

(this sample)

TrickBot

DLL dll 9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015

  
URLhaus
https://urlhaus.abuse.ch/url/1539521/
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
  
Dropping
MD5 e92d50f4349ca1a51784fa8155f699e1

Comments