MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74
SHA3-384 hash: 3df5f25caa6db7058c54ae256bbfa356848c02a6510c2587129509a1fc8e996a3612d0b15b830e4d5eed14111019d4b5
SHA1 hash: 7ecc9e51c990aecba31671b3a39842517efba317
MD5 hash: e85da3c5a35a887685ff4ce6bb360ade
humanhash: summer-april-tango-potato
File name:e85da3c5a35a887685ff4ce6bb360ade.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:335'360 bytes
First seen:2021-03-16 19:28:21 UTC
Last seen:2021-03-16 21:31:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash bd987b71f4cf5e45a335d1b833a3b85f (1 x TrickBot)
ssdeep 6144:j5Cug2UFF2KDba5eg24xQ7ZV94MFT0R1uwMZ:jbBeEegfxQ7ZV944T0nMZ
TLSH 6364CF86A3148A70DB9DF83D5C68CB2647873F4DE6A1415539B8FF1A5EB938008E4F4B
Reporter abuse_ch
Tags:dll mon142 TrickBot

Intelligence

File Origin
# of uploads :
3
# of downloads :
327
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/124423/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.27235.12468.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/67669973-0290-48bc-86a5-dea760c2bf87
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/641318
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 369635 Sample: FkybLVhVyC.dll Startdate: 16/03/2021 Architecture: WINDOWS Score: 48 29 Multi AV Scanner detection for submitted file 2->29 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 1 75 10->16         started        18 cmd.exe 12->18         started        process6 20 iexplore.exe 150 16->20         started        dnsIp7 23 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49732, 49733 YAHOO-DEBDE United Kingdom 20->23 25 prod.appnexus.map.fastly.net 151.101.1.108, 443, 49730, 49731 FASTLYUS United States 20->25 27 12 other IPs or domains 20->27
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 19:29:05 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uad36ibxzf7w6su4dficybadwnxafmggk6vrkktgdusquokx7r2a._file
Verdict:
unknown
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon142 banker trojan
Link:
https://tria.ge/reports/210316-xedzdmg9kj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74
MD5 hash:
e85da3c5a35a887685ff4ce6bb360ade
SHA1 hash:
7ecc9e51c990aecba31671b3a39842517efba317
Link:
https://www.unpac.me/results/c5f75f5e-9815-4863-986d-8153d0fa61d2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1071467/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/124423/
  
URLhaus
https://urlhaus.abuse.ch/url/1072479/

Comments