MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4
SHA3-384 hash: 5982f22d389dc417cfc890eaa9a74c2042d5a0ab825bc8686b5871a2b3c4ad22a5a330a8e112c6b22876f47d84161163
SHA1 hash: 40adffa15d0cb2daf04d3e51dcf0d29421387f9c
MD5 hash: ac75d6634acbce0bc12d83e68658e7ef
humanhash: helium-alaska-johnny-two
File name:Joret.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:338'432 bytes
First seen:2021-02-16 14:49:20 UTC
Last seen:2021-02-16 15:59:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash b82bbf3729deb0f97724bc2e069c3071 (1 x TrickBot)
ssdeep 6144:F+ZE0J3qMwtXD+Y6L3umbgDS67CMSsa9clQgOjEmnuvqrg+lr0XjUj:F+ZLxz8DSWkJc6du2g+lrAjUj
Threatray 1 similar samples on MalwareBazaar
TLSH F374BF10B5B4041DEBBE4B77346DFAC1CD7C66982EACCA5F232D868D4B2C473A127562
Reporter Scoobs_McGee
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
160
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117363/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
n/a
Score:
23 / 100
Link:
https://www.joesandbox.com/analysis/609070
Signature
Machine Learning detection for sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 353563 Sample: Joret.dll Startdate: 16/02/2021 Architecture: WINDOWS Score: 23 25 Machine Learning detection for sample 2->25 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 regsvr32.exe 8->12         started        process5 14 iexplore.exe 1 74 10->14         started        process6 16 iexplore.exe 151 14->16         started        dnsIp7 19 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49773, 49774 YAHOO-DEBDE United Kingdom 16->19 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49766, 49767 FASTLYUS United States 16->21 23 10 other IPs or domains 16->23
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 14:50:07 UTC
File Type:
PE (Dll)
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzzrjiicdeqt4o7bx6v2q7zkgdtotufw35xg5xlgqpkmwu3m4xca._file
Verdict:
unknown
Similar samples:
5670742a4eff2e01af5d2d8c29f6613683368b5b5f57517e67c695db3771d18f
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob57 banker trojan
Link:
https://tria.ge/reports/210216-h52tlt396j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
Unpacked files
SH256 hash:
ac79ffe65f317f6ad1fa3fedff18f23fb985b243ec0ff7c70dfb622635c7194a
MD5 hash:
17c237dc3afd9459edabab092d46e658
SHA1 hash:
79984a54153bc25fa6e8046921f51052ab9c9a8c
Link:
https://www.unpac.me/results/646e8ff4-35bb-4e5c-a796-b4f1f1641e9d/
SH256 hash:
f0255104f2ffe54c3eeaedfa6c6eb6d024d6f950315902306d56ff75b5f425cf
MD5 hash:
fd22365edf198639447e5dd14f8600c4
SHA1 hash:
766c6bdbf54d56130066a6570851c2f9161f751b
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/646e8ff4-35bb-4e5c-a796-b4f1f1641e9d/
Parent samples :
9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4
1e749ea17f499e72237981072900998abc755bdcd0286b968d731e241c1a744a
SH256 hash:
9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4
MD5 hash:
ac75d6634acbce0bc12d83e68658e7ef
SHA1 hash:
40adffa15d0cb2daf04d3e51dcf0d29421387f9c
Link:
https://www.unpac.me/results/646e8ff4-35bb-4e5c-a796-b4f1f1641e9d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

DLL dll 9e7314a10219213e3be1bfaba87f2a30e6e9d0b6df6e6edd6683d4cb536ce5c4

(this sample)

anyrun
any.run
https://app.any.run/tasks/63368cb2-e3c1-4107-80b3-58b6f4f1499a#
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/117363/
  
URLhaus
https://urlhaus.abuse.ch/url/1012932/

Comments