MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60
SHA3-384 hash: 0a268a0f120f4b6de4adf872baf26cbb3edcddd7568f55814a6dac8897a520d6910be896b675b77c2022e249f0a2e442
SHA1 hash: daceb19ebb5b9938a49e39174d716d769f2d12fe
MD5 hash: e905846ca83adae7c9fa32e55ed1b826
humanhash: magazine-gee-beryllium-echo
File name:linas138.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:291'328 bytes
First seen:2021-03-16 05:21:07 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 10692b69586a6cd6b934d4fc52bc47e2 (2 x TrickBot)
ssdeep 6144:0XbKnoIz7ZJrdnvfxvlFwS3Er3MRaXtktiqMLU:0XWHRRNCoRwSMg
TLSH E35402056BE199B7D0651B3044F6C2752B7FEC50A6A2834B2FC43EAB7E71B905D0839B
Reporter bomccss
Tags:mon138 TrickBot


Avatar
bomccss
hxxp://yuvikadvertisments.com/wp-content/plugins/js_composer/config/buttons/linas138.dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.8401.6959.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d98dd493-f9e2-43f9-8bc6-5caec888612e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/640301
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 369124 Sample: linas138.dll Startdate: 16/03/2021 Architecture: WINDOWS Score: 48 29 Multi AV Scanner detection for submitted file 2->29 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 2 84 10->16         started        18 cmd.exe 12->18         started        process6 20 iexplore.exe 5 152 16->20         started        dnsIp7 23 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49741, 49742 FASTLYUS United States 20->23 25 geolocation.onetrust.com 104.20.184.68, 443, 49726, 49727 CLOUDFLARENETUS United States 20->25 27 8 other IPs or domains 20->27
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-16 00:25:33 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lld4tjaxx4qap3uf5j66u6m3u2d47zo4vgknxauxcrhbj4rmlzqa._file
Verdict:
unknown
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon138 banker trojan
Link:
https://tria.ge/reports/210316-7k635lfj96/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
596a06a9f2010de1df61a92977789af48c58dcca56b4169b532ee79b5fd6db24
MD5 hash:
eeacb76d0c98b7f872eb86de5cdcbf75
SHA1 hash:
1cb6c01ecaaa5c9847c365fee0edcda6506c2def
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/1d3ec119-22c1-4702-b0d3-e503c513abff/
SH256 hash:
5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60
MD5 hash:
e905846ca83adae7c9fa32e55ed1b826
SHA1 hash:
daceb19ebb5b9938a49e39174d716d769f2d12fe
Link:
https://www.unpac.me/results/1d3ec119-22c1-4702-b0d3-e503c513abff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 5ac7c9a417bf2007ee85ea7dea799ba687cfe5dca994db8297144e14f22c5e60

(this sample)

  
Link
https://tria.ge/210316-22qz3d4ktj
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1070193/
  
URLhaus
https://urlhaus.abuse.ch/url/1070197/
  
URLhaus
https://urlhaus.abuse.ch/url/1070391/

Comments