MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881
SHA3-384 hash: fe792eb6f450a5830032dc73f9de845ddc1ed5e4b7d9468ca02e8319343007b06af8df67b437fa17c7aa83ac0852d55b
SHA1 hash: b8b82548d38ca7c4e3fe869c354c19a235c73a8b
MD5 hash: 12415ac367fed2398dc236c7b0838f4a
humanhash: oranges-saturn-purple-comet
File name:7.attach.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:544'768 bytes
First seen:2021-03-04 18:18:01 UTC
Last seen:2021-03-04 19:50:01 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash ac255e1388119b5cc86181566c294cbc (1 x TrickBot)
ssdeep 12288:+fg5XVUfXdAzzGZIPPMc5amPA3znFhvCkdpNt:Og5XVFzyZ0kDzn/CMNt
Threatray 3 similar samples on MalwareBazaar
TLSH DAC4C01135E4C479DAEF02381B7A5B28A7F9FD606BF1D1C793C05A5D1E339829A3231A
Reporter James_inthe_box
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122329/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.15266.3330.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/629007
Signature
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 363476 Sample: 7.attach.dll Startdate: 04/03/2021 Architecture: WINDOWS Score: 52 27 Multi AV Scanner detection for submitted file 2->27 29 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->29 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 1 74 10->16         started        process6 18 iexplore.exe 157 16->18         started        dnsIp7 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49732, 49733 FASTLYUS United States 18->21 23 geolocation.onetrust.com 104.20.185.68, 443, 49720, 49721 CLOUDFLARENETUS United States 18->23 25 8 other IPs or domains 18->25
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881/
Threat name:
Win32.Spyware.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 18:17:25 UTC
File Type:
PE (Dll)
Extracted files:
22
AV detection:
10 of 28 (35.71%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db
TrickBot
c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
TrickBot
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob70 banker trojan
Link:
https://tria.ge/reports/210304-rtjklqp8tn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
2ed597669e9407fa664c4fd26684a84dbb73681400d966d41185c240bcfe5051
MD5 hash:
bf6b7b0ad4d347934eb2ddb0f9b146c4
SHA1 hash:
9b65330f45273c9d750b52ec2235a414e91a72fd
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/32d4c0e7-9295-43cc-9b43-5eed141b7550/
Parent samples :
b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881
d9882294caa558fc01c900fe07e6d3f24acc46110bd8c2206e311139e9f13386
SH256 hash:
40ec24a9ae4d1a2acbc6983be91c5e90872374b750b9df11eb79a7715701c4ce
MD5 hash:
3112ed11877d1e6df127911f3d4d308d
SHA1 hash:
4af329d4e8c315e17711c9c92831f36bb222a1c6
Link:
https://www.unpac.me/results/32d4c0e7-9295-43cc-9b43-5eed141b7550/
SH256 hash:
88e28425eb06ff70c709c62b47e9e0ad9b8e7a9872ef231a5313bd53809dbe78
MD5 hash:
0ca2026839450a7c7d75a9b0327fa5d7
SHA1 hash:
3ab7ec4fb50301395011a802d69aa80931768d7d
Link:
https://www.unpac.me/results/32d4c0e7-9295-43cc-9b43-5eed141b7550/
SH256 hash:
b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881
MD5 hash:
12415ac367fed2398dc236c7b0838f4a
SHA1 hash:
b8b82548d38ca7c4e3fe869c354c19a235c73a8b
Link:
https://www.unpac.me/results/32d4c0e7-9295-43cc-9b43-5eed141b7550/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/1047006/
Cape
Cape
https://www.capesandbox.com/analysis/122329/

Comments