MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 638c40fa8171bcfb74a8643b30b3a1080237bec13e22606ac06a6309070a4116. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 638c40fa8171bcfb74a8643b30b3a1080237bec13e22606ac06a6309070a4116
SHA3-384 hash: ffa9eb28e1f0c61051aac55c04ae893b5a217535d389ebd04f13c405d204862e64cefb5b7023558ced2dc4f7b7a01b66
SHA1 hash: 3d08281fb42ace70c354aadae4ebc98551e968b4
MD5 hash: 60daebb214a6812f4582e495a5c84674
humanhash: twelve-oven-helium-nevada
File name:update.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:618'496 bytes
First seen:2020-06-26 06:18:07 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 37f5c39cb3736772265a9e1aa907287c (2 x TrickBot)
ssdeep 12288:FXVXH8QqvVh9R/oH+RGNxPnjXDnB1RLy:FXRcLj0qGNxPjLBTW
Threatray 5'076 similar samples on MalwareBazaar
TLSH 0CD47C0029F0DCB4ED210F7A7125D6BE0E76744A8B2F56C76FA60CB6B9241E89D71327
Reporter abuse_ch
Tags:dll TrickBot


Avatar
abuse_ch
TrickBot payload URL:
http://185.14.31.137/images/update.dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/14605/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Generic.mg.87c3911bf736c424.28595.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Unauthorized injection to a system process
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/638c40fa8171bcfb74a8643b30b3a1080237bec13e22606ac06a6309070a4116/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2020-06-26 06:20:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
8423fefddbb9197ebe12a5e51fb8f06e6dc2c02d6ef68b254faba0d6a63866c5
TrickBot
8af7651e5c9bbc5e999a745ed4747d9e9e54fb425f824c7438ac07a00f834612
TrickBot
8c47730867b57083f6ec4ab8c237f32f556c04ee4a973f2fc1c1be2919e49199
TrickBot
97c6fdb81fcc7d56b44c314ad21d2ef5e85299e18cff95cebc54b9192c025902
TrickBot
99d62f68414740eb9e6c2719cf22d67e5f5f4cb3fe0a4be34e7438d826844ff5
TrickBot
9ac40f570749efc9e1cdad4ee9cd2446bf3e1dbfd3fe9b645169ee010f561084
TrickBot
a97d416fd7fc1f37199012e44f1d6b1946b59f7d6b92b89d38dbee74a18c7554
TrickBot
b65ca1af4590bbec9aa558319c6491db8235a555de83345e71b69feb69163e58
TrickBot
c7b6b5c5fd0241015dea2d5bf76f50143844676bec4b1a57284af92a75a367db
TrickBot
ea78f793d2de0b9b6da1ddd8530de9c646f3bbaa115f0cbcd7339ddfb5c3b0f7
TrickBot
+ 5'066 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200626-3tprhfzb5j/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Excel file xls 8fa5e3d146cef3c8306519592ebe8b241feebc11adc47b6a55a9267f068145f3

TrickBot

DLL dll 638c40fa8171bcfb74a8643b30b3a1080237bec13e22606ac06a6309070a4116

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/402152/
  
Dropped by
MD5 93a2b8c720c56a9886e0dd802f8ba272
  
Dropped by
SHA256 8fa5e3d146cef3c8306519592ebe8b241feebc11adc47b6a55a9267f068145f3
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/14605/

Comments