MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a
SHA3-384 hash: 908af0ef19c1534a6a7db99ab64ce61cef29b42f5403a1a2f8cbabe5e76fd0915fce105fa32c1e9c71137d25b91bd4bc
SHA1 hash: 31665331a602e39481fd00e3dfe7869bb5fb5280
MD5 hash: c6fcd45cbffe733beab01bd9d7706615
humanhash: golf-april-three-golf
File name:c6fcd45cbffe733beab01bd9d7706615
Download: download sample
Signature TrickBot
Create hunting rule
File size:540'672 bytes
First seen:2021-06-11 14:32:31 UTC
Last seen:2021-06-11 15:49:02 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 528e27d2cc3d057ff5499c1ccde0cb87 (1 x TrickBot)
ssdeep 12288:1kPMN7eLQ0DzEPDCc/TwV91gTMA2E9dnTRYUr5:1/OQm2sV91gTMzad9YU
Threatray 777 similar samples on MalwareBazaar
TLSH EDB4E10232E48877D1EF12354967C3996AB9BE115AB5C68FAFD8358E1D312418E33B37
Reporter zbetcheckin
Tags:dll exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166137/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46466228.16647.15417.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a UDP request
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Forced shutdown of a system process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7f71a6a0-0359-4f4a-884a-6c3915e0fb1c
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/800931
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 433327 Sample: 1EFNborqwh Startdate: 11/06/2021 Architecture: WINDOWS Score: 48 33 Multi AV Scanner detection for submitted file 2->33 8 loaddll32.exe 1 2->8         started        process3 process4 10 iexplore.exe 1 73 8->10         started        12 cmd.exe 1 8->12         started        14 rundll32.exe 8->14         started        16 2 other processes 8->16 process5 18 iexplore.exe 146 10->18         started        21 rundll32.exe 12->21         started        23 cmd.exe 14->23         started        dnsIp6 27 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49741, 49742 YAHOO-DEBDE United Kingdom 18->27 29 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49743, 49744 FASTLYUS United States 18->29 31 10 other IPs or domains 18->31 25 cmd.exe 21->25         started        process7
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
3ab24a8fd91dc87da83930eb33c9bab160031eaca849f9ecc32448b386e2f724
TrickBot
3cd2b72f85d145e8bfc5fadc184e97d6d102e3b22a45815358c43538c9c1dc18
TrickBot
437d0b75f67c18c12a35d9c0e1a32fc57b426834fa4df63f30f11cb17dd24528
TrickBot
507a6d57570a5774ce656a1b82535a4992e2320c6a760a5e957665263bf102cd
TrickBot
63460db804ae28d642ede8b1c6126958dc0d42c4e526903fca6e147569a7b9d0
TrickBot
678de819abf5f00b28eaaa8239169a08a75050a4df26fe3ce5b262d6c7b6cb24
TrickBot
87402c2ee3595cd862dbb82648aa9ebf17d41ceb05f912e50493d9ba96acb9a4
TrickBot
acb81dadb44ea5fac7a47aa1829865e765524bff935c74e2f31af97ed81b7479
TrickBot
be98cf40b1ba5dafde4834ba50fb1dc697e456b9f93cb437842f5177160c9fad
TrickBot
c22df6708ee597cfbc4079d96503e8159104cdf1f0d3a9fecb6741a9e152d0b2
TrickBot
+ 767 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:sat1 banker trojan
Link:
https://tria.ge/reports/210611-3qb2ccxqcs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
178.72.192.20:443
103.124.145.98:443
45.5.152.39:443
114.7.240.222:443
85.248.1.126:443
94.183.237.101:443
146.196.121.219:443
89.37.1.2:443
94.142.179.77:443
177.221.39.161:443
85.175.171.246:443
103.12.160.164:443
180.178.106.50:443
94.142.179.179:443
46.209.140.220:443
123.231.149.122:443
123.231.149.123:443
182.160.116.190:443
131.0.112.122:443
116.0.6.110:443
103.101.104.229:443
88.150.240.129:443
103.242.104.68:443
Unpacked files
SH256 hash:
8c83c7574bd2aaeb7650a4c722a285090efddfda1ffd5f16524023e13a29a681
MD5 hash:
ed2dc60386eeacb7e5b8b2b5ff6b67f2
SHA1 hash:
c9714a3630633109f84688119afdc26afb343ca7
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/cb6ca1ce-3ba5-4388-9855-b72c5956c185/
SH256 hash:
ec4f3db897d078e3510da6df61a0e5e0963c5029bb08042b75cb7d7d97767fec
MD5 hash:
f273d55daaf384476c3b15fbfc7b22c9
SHA1 hash:
bc282931df7dde8487a04e2a028fa75aa1e8bc2a
Link:
https://www.unpac.me/results/cb6ca1ce-3ba5-4388-9855-b72c5956c185/
SH256 hash:
3dddc9158c728305f9f35851c3794f6d763083984df5269ea9315eae44d68b68
MD5 hash:
03aa08ed6039b9c954046d3df9d53e9a
SHA1 hash:
4621df9da438de5d5f9b83496f37bf3add00deaa
Link:
https://www.unpac.me/results/cb6ca1ce-3ba5-4388-9855-b72c5956c185/
SH256 hash:
0b3a7ddc40447fceda6ac4a85436f75b341817d775f536805f3f18938982c85f
MD5 hash:
5f0389e75ed389332b4b1ae032246f09
SHA1 hash:
09c6d023a2a7c441eafc632334cb8699023ebb6c
Link:
https://www.unpac.me/results/cb6ca1ce-3ba5-4388-9855-b72c5956c185/
SH256 hash:
896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a
MD5 hash:
c6fcd45cbffe733beab01bd9d7706615
SHA1 hash:
31665331a602e39481fd00e3dfe7869bb5fb5280
Link:
https://www.unpac.me/results/cb6ca1ce-3ba5-4388-9855-b72c5956c185/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 896b649c68a4c744c0bcab8c1918732ef1c82bb51ffaea777d3035867bd2787a

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/166137/

Comments