🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5
SHA3-384 hash: 132d2478792d1273e86bd0ff44871970e3871188ee4809f388114f29b0fab9f999ddf97d3913008feef52d190d75a174
SHA1 hash: 84ce61490587d848295aa5eebfdd502c50e200bc
MD5 hash: 7cc91fb0c73b92f4dcb529b5c2489489
humanhash: stream-bakerloo-blue-princess
File name:7cc91fb0c73b92f4dcb529b5c2489489.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:757'760 bytes
First seen:2021-03-20 08:24:11 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 27af48f5c723652212203558f954e963 (3 x TrickBot)
ssdeep 12288:+GkcUcJTpz8UmB12ZUpWoba8GqcBkZFIt0moryt:ecjpoXf2Z7oba8GqmkHICdO
Threatray 7 similar samples on MalwareBazaar
TLSH C4F4BF03F9A0D1F1D27D647468514B2156E9ECA0EEF9C6C35F85FE8D8A362C2622D393
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
418
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/125773/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36523264.14379.13537.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8ff3b18b-b3b3-4be3-bb0c-1f942b15b52f
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/646807
Signature
Multi AV Scanner detection for submitted file
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 372372 Sample: uSokhVt4Op.dll Startdate: 20/03/2021 Architecture: WINDOWS Score: 56 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Trickbot 2->31 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 20 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 1 74 10->16         started        18 cmd.exe 12->18         started        process6 20 iexplore.exe 158 16->20         started        dnsIp7 23 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49715, 49716 FASTLYUS United States 20->23 25 geolocation.onetrust.com 104.20.184.68, 443, 49700, 49701 CLOUDFLARENETUS United States 20->25 27 9 other IPs or domains 20->27
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-19 19:37:19 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbwamclzlu44weafsksxxdymzozdqcpw656fvpalv22dz4lxvw2q._file
Verdict:
malicious
Similar samples:
12c758880559bf8d54aa665bf63bd8fb3009d9df405515a55a20438509c4fbf5
TrickBot
32682ea9ee36a960cf405dbcc69d9140e82c07494f66b234dd6eca1a72a4d398
TrickBot
44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157
TrickBot
aed2b8d91256d038c0452ec74b6757f667955ae2d1488a2c5ab0b97c5fa8b2ee
TrickBot
b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9
TrickBot
b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6
TrickBot
f18e37c957973e11af3e470a4ca4d350537ff72af51a01b02b8d45e5600b1e80
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon148 banker trojan
Link:
https://tria.ge/reports/210320-pxf8cz2j92/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
48c9a3b70e0dd1c1a80b42915011aaf77c166603026088e47009074733b1fd93
MD5 hash:
a6b70f9f49a43d1e80b5691a91a64b3f
SHA1 hash:
191c291920451990a30ad1aa3d8a2f901187551c
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/85cb9688-2aa5-4c45-8b1f-42e44adf78bf/
SH256 hash:
7ceb3ac39e447d598610a218fd9101d06e3500f2d726429d04ea01bc72e16d84
MD5 hash:
99006fc0b2a5c6c351b8c061ff394f01
SHA1 hash:
8fe22f8d713d575a05b605de5189faa7b01d68bc
Link:
https://www.unpac.me/results/85cb9688-2aa5-4c45-8b1f-42e44adf78bf/
SH256 hash:
56f0292dbf855baac85b8f7db976796808515c0670edbcb88e8e1b9c79dae4ce
MD5 hash:
6f619279e426d2aff8daae849a93f02e
SHA1 hash:
b1f86229327fa2a8680477fe283357a01a802331
Link:
https://www.unpac.me/results/85cb9688-2aa5-4c45-8b1f-42e44adf78bf/
SH256 hash:
606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5
MD5 hash:
7cc91fb0c73b92f4dcb529b5c2489489
SHA1 hash:
84ce61490587d848295aa5eebfdd502c50e200bc
Link:
https://www.unpac.me/results/85cb9688-2aa5-4c45-8b1f-42e44adf78bf/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 606c0609795d39cb100592a57b8f0ccbb23809f6f77c5abc0baeb43cf177adb5

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/125773/
  
URLhaus
https://urlhaus.abuse.ch/url/1077782/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1077843/
  
URLhaus
https://urlhaus.abuse.ch/url/1077958/
  
URLhaus
https://urlhaus.abuse.ch/url/1077996/
  
URLhaus
https://urlhaus.abuse.ch/url/1078044/
  
URLhaus
https://urlhaus.abuse.ch/url/1078073/

Comments