MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58cdbb2c17ea6d6eb5a1c6952a8c6bf9e918c51bfc58a2639d2cf031b359da06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58cdbb2c17ea6d6eb5a1c6952a8c6bf9e918c51bfc58a2639d2cf031b359da06
SHA3-384 hash: f41828a1a8c50e266f722e14b8929311ead4b492a5155c9737b14bae469d12da9852a13d4bb4426d50c95543fdf04c41
SHA1 hash: b321f66d1a06ef9883ca06d78e0f0b2dd1705c93
MD5 hash: ac11833ad6b6b6b894c8afc1bcb68140
humanhash: yankee-kitten-florida-fish
File name:ac11833ad6b6b6b894c8afc1bcb68140.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:361'472 bytes
First seen:2021-02-15 20:15:20 UTC
Last seen:2021-02-15 21:49:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ee693e3bb4d5864fb5995225a53cea3c (3 x TrickBot)
ssdeep 6144:MvcW/D6HvoYb988GdTIKEXv/ZwHxIdfrYOxO6c8PCJV:M0E6Po498tTlEHZwRaYoO6uJV
TLSH C5747C00B571051DD7AA43B314ADBEC29A3866887F7CCB5F666E08DF5728933710FA92
Reporter abuse_ch
Tags:dll mon57 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/117243/
Detection(s):
SecuriteInfo.com.Generic.mg.ac11833ad6b6b6b8.21483.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/608436
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 353247 Sample: DUcKsYsyX0.dll Startdate: 15/02/2021 Architecture: WINDOWS Score: 52 25 Multi AV Scanner detection for submitted file 2->25 27 Machine Learning detection for sample 2->27 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 regsvr32.exe 8->12         started        process5 14 iexplore.exe 2 72 10->14         started        process6 16 iexplore.exe 153 14->16         started        dnsIp7 19 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49747, 49748 FASTLYUS United States 16->19 21 geolocation.onetrust.com 104.20.184.68, 443, 49733, 49734 CLOUDFLARENETUS United States 16->21 23 8 other IPs or domains 16->23
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/58cdbb2c17ea6d6eb5a1c6952a8c6bf9e918c51bfc58a2639d2cf031b359da06/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 20:16:08 UTC
AV detection:
10 of 29 (34.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ldg3wlax5jww5nnby2ksvddl7hurrri37rmkey45ftyddm2z3ida._file
Verdict:
unknown
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon57 banker trojan
Link:
https://tria.ge/reports/210215-g1brcw8y72/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
Unpacked files
SH256 hash:
60c9dc37c613f9db6184f3cb0671ec5adf66f5adac682f455c08a1440865da11
MD5 hash:
e7261dce4178d7a90c829fcea5aa89f8
SHA1 hash:
ca7d87c8a4ebe2652efdcbb448b5540f8d93f7f2
Link:
https://www.unpac.me/results/669e0162-fe1a-4aa0-8b18-84d65b53ae5b/
SH256 hash:
37b7f675a9f9fee97bb4a16d624496019c8300f993def1c967d70fc64f8651f0
MD5 hash:
077f44df521f03b0d264bca595112c44
SHA1 hash:
860a1ddce2938fa30cd98dc8d7519ea299138402
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/669e0162-fe1a-4aa0-8b18-84d65b53ae5b/
SH256 hash:
58cdbb2c17ea6d6eb5a1c6952a8c6bf9e918c51bfc58a2639d2cf031b359da06
MD5 hash:
ac11833ad6b6b6b894c8afc1bcb68140
SHA1 hash:
b321f66d1a06ef9883ca06d78e0f0b2dd1705c93
Link:
https://www.unpac.me/results/669e0162-fe1a-4aa0-8b18-84d65b53ae5b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58cdbb2c17ea6d6eb5a1c6952a8c6bf9e918c51bfc58a2639d2cf031b359da06

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 58cdbb2c17ea6d6eb5a1c6952a8c6bf9e918c51bfc58a2639d2cf031b359da06

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1011566/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117243/

Comments