MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db
SHA3-384 hash: d70519d243e900f17186549d58d7f511adfc8180c9763344f5abe37226e2b25e46e129962fd4bdceccb1402a8c4b4ab8
SHA1 hash: f74e55dbe006d8f120c7a8bbd77713d309689648
MD5 hash: 0b7e2ae69ce9b9577ee7ca17926fd654
humanhash: florida-mexico-ten-floor
File name:mon103.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:602'112 bytes
First seen:2021-03-03 23:33:09 UTC
Last seen:2021-03-04 08:15:37 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 797384ad59f07b968b9c5c867c00b02f (3 x TrickBot)
ssdeep 12288:Q7fcBXTEC7wfnmB/fjOFSycf90/Li67t/5lWTfEcEQFB:zEC7h88fylt/5gVFB
Threatray 5 similar samples on MalwareBazaar
TLSH 6AD4CF13B6E2C135D5AF02303E65AB79A2FDF9609DF6CA8777C0DA1C8D31941CA16326
Reporter Cryptolaemus1
Tags:dll mon103 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/122131/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.12251.22480.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/626990
Signature
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 362480 Sample: mon103.dll Startdate: 04/03/2021 Architecture: WINDOWS Score: 52 27 Multi AV Scanner detection for submitted file 2->27 29 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->29 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 20 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 2 85 10->16         started        process6 18 iexplore.exe 5 151 16->18         started        dnsIp7 21 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49743, 49744 YAHOO-DEBDE United Kingdom 18->21 23 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49745, 49746 FASTLYUS United States 18->23 25 11 other IPs or domains 18->25
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 23:34:12 UTC
File Type:
PE (Dll)
Extracted files:
26
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i5j2tbeax7tkuvuf5wyekzscm6pu4son7fdsifi7koqzdj2ychnq._file
Verdict:
malicious
Similar samples:
092223938bed5fec479602f4bf2cb0fd28dd628e8754714047b0b7939cd2e298
TrickBot
99a6c8e156dba4fda6e2b6ca0802cc08d49556b489e97618e565768329521413
TrickBot
b7823b23e2ef21045e77a01f2f34f86f387a607f4c1d949571c01c1fcdfd7fa1
TrickBot
c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
TrickBot
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon103 banker trojan
Link:
https://tria.ge/reports/210303-8hrhlzxfbx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
abf9020194a0939e16c0f728565ad28140af4e3719c0c5725799716d9d7a52a2
MD5 hash:
47ccd41faa2e2395f3616c239de55c17
SHA1 hash:
3516067a3e71f973cbdbb14613e2915c19f57d24
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7271f40a-158d-438c-a7be-758dc9b318b9/
SH256 hash:
e5c7880c1cb8d512e79316d989326a853b11cd5e16097270dd4260a3c68446af
MD5 hash:
e7e7bb6a8fbf964a5cdcc9bbe49fa624
SHA1 hash:
c929b85a276c782755892cc4e87d705376eef6d1
Link:
https://www.unpac.me/results/7271f40a-158d-438c-a7be-758dc9b318b9/
SH256 hash:
9a6e61434ba425b014d6bb38dcb67d738b6fe43b7148e31de7c5f8febce8f01a
MD5 hash:
0d06ce3a694e75abc7555a43ffbc0739
SHA1 hash:
d0d0ea04fbed5a4d7ffbad8bac9ee32e7b68a0c4
Link:
https://www.unpac.me/results/7271f40a-158d-438c-a7be-758dc9b318b9/
SH256 hash:
4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db
MD5 hash:
0b7e2ae69ce9b9577ee7ca17926fd654
SHA1 hash:
f74e55dbe006d8f120c7a8bbd77713d309689648
Link:
https://www.unpac.me/results/7271f40a-158d-438c-a7be-758dc9b318b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/1045274/
  
URLhaus
https://urlhaus.abuse.ch/url/1045291/
  
URLhaus
https://urlhaus.abuse.ch/url/1045292/
  
URLhaus
https://urlhaus.abuse.ch/url/1045293/
Cape
Cape
https://www.capesandbox.com/analysis/122131/
  
URLhaus
https://urlhaus.abuse.ch/url/1045947/

Comments