MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fc26c2376ee0d315bb25dd72cabe42191aba0a9fc4fc1c0ffc8566d25c9636b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fc26c2376ee0d315bb25dd72cabe42191aba0a9fc4fc1c0ffc8566d25c9636b
SHA3-384 hash: d359b84773629fe7d014aaae78ff8c2e98429ccbddeb358573cf13190763d81e1aba5a94910ae6d0c3f5af3f6bfd124b
SHA1 hash: b003182f6a34080a4e1503b79de8b604b2726dcf
MD5 hash: 334b944e6fa7035ebd8ae2caec52e5e0
humanhash: green-carolina-maine-uranus
File name:SARS-2_form_V3935.doc
Download: download sample
Signature TrickBot
Create hunting rule
File size:199'682 bytes
First seen:2020-04-17 07:00:13 UTC
Last seen:Never
File type:Word file doc
MIME type:application/vnd.openxmlformats-officedocument.wordprocessingml.document
ssdeep 3072:mr1nGejy2BdT/Hha6TLzHzIhVW2BE3DTwJWj33LkMRkhf:I5rjHf/HhauLzHQVjWzwWj33LkMRQ
Threatray 2'902 similar samples on MalwareBazaar
TLSH 6A1412A631835D44E81346780C478EFBF36F45A39144BBE672ACBAD1E34349F2A3D526
Reporter abuse_ch
Tags:COVID-19 doc TrickBot


Avatar
abuse_ch
COVID-19 themed malspam campaign distributing TrickBot, various subjects and sending IPs. Examples:

HELO: vps-4222855.ronnivicente.com
Sending IP: 162.214.50.206
From: "Madeline Wright" <NicholasPatterson@General-Hospital.int>
Subject: World-wide coronavirus examination!
Attachment: SARS-2_form_V3935.doc

HELO: ns7.top-consulting.net
Sending IP: 65.39.216.48
From: "Layla Anderson" <JaxonHoward@CoVirus.com>
Subject: Fast Covid-19 checking!
Attachment: Medical_List_CoVid_A7195.doc

TrickBot payload URL:
http://classic.theinflammatorytruth.com/4810fc8cbad496eidZRVbY9Bv.dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.EnterSandMan.2020402.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.ExecFuncSubCatSuckedOutTheFeeling.20200402.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.HowardTheDuck.20200408.UNOFFICIAL
Create hunting rule

Doc.Downloader.Protected00-7648360-0
Create hunting rule

Gathering data
Threat name:
Document-Word.Trojan.Donoff
Create hunting rule
Status:
Malicious
First seen:
2020-04-17 07:35:33 UTC
File Type:
Document
Extracted files:
91
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7bgyi3w5ygtcw5slxlszk7eegi2xifj7rh4dqh7zblg2jojmnvq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
1d548c3158019bf9de332a8fa34dd6d3ae3e4151bb896918eb2fd137860f21da
TrickBot
25ac7e0410299ac6572befc8784420ecbc829ab0db38a7eb46a83855b419212f
TrickBot
2d0d08b27eec389f3edd036b4bb4ded2c24500bf53dba2a3a46eb2ecd36105e6
TrickBot
546ba5ce0a83d3dbc31ee21e174438c9e3794834de8d11a47f04f1ce005cd67d
TrickBot
764553cbeade2cc41c018b08fb22381a32a6c475b86353458d8fbc1aab86afeb
TrickBot
b91806669badbb92a759c17347d1fcc549c813a884ae1cee8d496fc1125ba17a
TrickBot
ccdc04adce0627519bf39c6491765a6c61b1ee62e188e4a329aee529623c92b8
TrickBot
d494077303e7a373e64379d2b7bb80695809d3c9c64c993d324775f33d8b798a
TrickBot
de064838cb87ab944c6a43f9ccfe42875ec2d4e0de7ecb3d61b92d3dcb44c5a9
TrickBot
f4001d5fcb0c67c66b6c2df8f1b1bf173b9b25277c72916105b424137bc90a9b
TrickBot
+ 2'892 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:win_alina_pos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_gootkit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Word file doc 7fc26c2376ee0d315bb25dd72cabe42191aba0a9fc4fc1c0ffc8566d25c9636b

(this sample)

TrickBot

DLL dll 1d548c3158019bf9de332a8fa34dd6d3ae3e4151bb896918eb2fd137860f21da

  
URLhaus
https://urlhaus.abuse.ch/url/342022/
  
Dropping
MD5 62a1a1c268a0cc99228eb21537e9e9a5
  
Dropping
SHA256 1d548c3158019bf9de332a8fa34dd6d3ae3e4151bb896918eb2fd137860f21da
  
Dropping
TrickBot
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1d548c3158019bf9de332a8fa34dd6d3ae3e4151bb896918eb2fd137860f21da

Comments