MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157
SHA3-384 hash: ebadd5554868441c5a21e0541ae43207225704bc7acf293667d8aeeb1a0cd25a2a7ea0cb23314ada185ac04d3dd84f4f
SHA1 hash: ead8f0f329a527ca48d5deccea347b46ad587ad8
MD5 hash: 1036309f7981780bb32ec44fa17a06b4
humanhash: jersey-mirror-football-failed
File name:1036309f7981780bb32ec44fa17a06b4.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:675'840 bytes
First seen:2021-03-13 09:02:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 25a3bf96f64b55a69d3aaf04f6c99acc (3 x TrickBot)
ssdeep 12288:D+QjOdLU2K5HmTbKbKKMFZys7tmwRoyuCmfEZO8KR3Pk:y/LUfU6MjvkfEZfKR3P
Threatray 2 similar samples on MalwareBazaar
TLSH 6BE46C8EE062C0B1E07561B4AF175F35919DDA923E2B898392E4FD4ADD233D1865F3C2
Reporter abuse_ch
Tags:dll mon127 TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/124114/
Detection(s):
SecuriteInfo.com.Variant.Zusy.371034.10014.22991.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/638599
Signature
Multi AV Scanner detection for submitted file
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 368276 Sample: kwVJBklshm.dll Startdate: 13/03/2021 Architecture: WINDOWS Score: 56 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Trickbot 2->31 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 20 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 1 73 10->16         started        18 cmd.exe 12->18         started        process6 20 iexplore.exe 150 16->20         started        dnsIp7 23 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49756, 49757 YAHOO-DEBDE United Kingdom 20->23 25 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49750, 49751 FASTLYUS United States 20->25 27 10 other IPs or domains 20->27
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-03-11 18:42:42 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=irruwuwzo2tv7smc7ulzcdt3zgc3xgccp74n35nyttwfcvj34flq._file
Verdict:
malicious
Similar samples:
12c758880559bf8d54aa665bf63bd8fb3009d9df405515a55a20438509c4fbf5
TrickBot
b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon127 banker trojan
Link:
https://tria.ge/reports/210313-cavmca7hwx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
58716b072ecb367b49aa702c0ec29388ce015162cbaacf00da5906ee7db99052
MD5 hash:
b61a3a8956ff83d4fd2afb84c276dcf9
SHA1 hash:
bd66eb29b927cff2fa3909ef9ecf6a2f296893e0
Link:
https://www.unpac.me/results/6f40d193-e487-461f-bafb-c462f42b63a9/
SH256 hash:
2ff1cc004713cf4fecb27cf4dcc55e1ab800ce4fe1f1a0ddb40a3765adc1bc07
MD5 hash:
7ed7a3b9517b788c376c4f1b7e912d70
SHA1 hash:
26f977c3af5c163a842f9977cc1411bf7e07e55d
Link:
https://www.unpac.me/results/6f40d193-e487-461f-bafb-c462f42b63a9/
SH256 hash:
425d5577cf38d038b8f1261b25f722b5aea0b83fd290aced279b9e70125351d9
MD5 hash:
276abfbb315d74f08d56deb6876b668f
SHA1 hash:
20fdebc65c619bbdaa109b6bdaac64f00a795fcc
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6f40d193-e487-461f-bafb-c462f42b63a9/
SH256 hash:
44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157
MD5 hash:
1036309f7981780bb32ec44fa17a06b4
SHA1 hash:
ead8f0f329a527ca48d5deccea347b46ad587ad8
Link:
https://www.unpac.me/results/6f40d193-e487-461f-bafb-c462f42b63a9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1064481/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/124114/

Comments