MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6fa679b595a6942226944f98077bbe75040a77db3b1c5ebdac4542ecad57bfbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6fa679b595a6942226944f98077bbe75040a77db3b1c5ebdac4542ecad57bfbc
SHA3-384 hash: 4c5370c8a364dbc2ddf7c810c6c9031c82cad47d7da9cb506b54e36542413c7cc5e6783753ef7271b99476b44cad4cbd
SHA1 hash: 5f379ba6b0adb0427c7a7d8c4f6b12da1d7b762e
MD5 hash: ffda87ae8127e7b6b061ac1f9c589d16
humanhash: magnesium-spring-iowa-sad
File name:Transaction.js
Download: download sample
Signature TrickBot
Create hunting rule
File size:138'096 bytes
First seen:2021-08-04 13:57:43 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 3072:RzRuF0zvbCqAwEu/SnpfEUKDmcjedPObLTw/E9Xuqq0UaijPsJjxsQM:RzRuF0zvbCqAwEu/SnpfJKDmcj7bRuRR
TLSH T1CCD36CA0BEC14103669F076BFD2316E5663EF9129288304BC1587B8D2E5E1DDC379EB9
Reporter abuse_ch
Tags:js rob120 TrickBot


Avatar
abuse_ch
Payload URLs:
https://files.zohoexternal.com/public/workdrive-external/download/ggi8w3183a1077e104d07a84291d0d5dcc1de
http://asesoriasconfood.com.co/magazine/magazine.php

TrickBot C2s:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Intelligence

File Origin
# of uploads :
1
# of downloads :
463
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.ISB.Downloadergen80.32064.32411.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6fa679b595a6942226944f98077bbe75040a77db3b1c5ebdac4542ecad57bfbc/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n6thtnmvu2kcejuuj6mao656oucau563hmof5pnmivbozlkxx66a._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210804-zz2ze656ss/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://asesoriasconfood.com.co/magazine/magazine.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6fa679b595a6942226944f98077bbe75040a77db3b1c5ebdac4542ecad57bfbc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Java Script (JS) js 6fa679b595a6942226944f98077bbe75040a77db3b1c5ebdac4542ecad57bfbc

(this sample)

TrickBot

DLL dll 892a84154516ef80df5f1764f1629c5254795669277f5ca324a035861d774cb7

  
URLhaus
https://urlhaus.abuse.ch/url/1505346/
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 892a84154516ef80df5f1764f1629c5254795669277f5ca324a035861d774cb7
  
Dropping
MD5 2ab4cc984ec0b93b82c0e4bf03aa8c5f

Comments