MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6
SHA3-384 hash: de9719098bad0a62ba93e2de51df4d3d434dd33790bfe1d0c39722d31847339b212307a3f72c525a3f87822cbb42bbec
SHA1 hash: 48a0c09f3659ed2ea2194eb03bbc79feab2b9c06
MD5 hash: 5bab87140fed67a1a1d4480753e68e46
humanhash: fifteen-fruit-finch-twenty
File name:SecuriteInfo.com.Variant.Bulz.398811.29781.31405
Download: download sample
Signature TrickBot
Create hunting rule
File size:757'760 bytes
First seen:2021-03-18 09:32:52 UTC
Last seen:2021-04-01 02:43:42 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 27af48f5c723652212203558f954e963 (3 x TrickBot)
ssdeep 12288:wGkcUcJTpz8UmB12ZVDaiI1rgCb0w4ev93ZrzfyTX9XLyt:EcjpoXf2ZBavAwltZrzMX9Xu
Threatray 5 similar samples on MalwareBazaar
TLSH 63F4BF03F9A0D1F1D27E647468514B2156E9ECA0EEF9C6C71F85FE4D8A362C2622D393
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/125420/
Detection(s):
SecuriteInfo.com.Variant.Bulz.398811.29781.31405.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/644220
Signature
Multi AV Scanner detection for submitted file
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 371069 Sample: SecuriteInfo.com.Variant.Bu... Startdate: 18/03/2021 Architecture: WINDOWS Score: 56 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Trickbot 2->31 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 20 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 1 73 10->16         started        18 cmd.exe 12->18         started        process6 20 iexplore.exe 156 16->20         started        dnsIp7 23 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49729, 49730 FASTLYUS United States 20->23 25 geolocation.onetrust.com 104.20.185.68, 443, 49717, 49718 CLOUDFLARENETUS United States 20->25 27 8 other IPs or domains 20->27
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-18 07:19:00 UTC
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wyl3pxfbqdhwpadg3i7p67aj3h4npgqqw4nidtelre24zf4oy7da._file
Verdict:
malicious
Similar samples:
12c758880559bf8d54aa665bf63bd8fb3009d9df405515a55a20438509c4fbf5
TrickBot
32682ea9ee36a960cf405dbcc69d9140e82c07494f66b234dd6eca1a72a4d398
TrickBot
44634b52d976a75fc982fd17910e7bc985bb98427ff8ddf5b89cec51553be157
TrickBot
b524ed1cc22253f09d56f54d8ded4566b63352ff739f58de961f8a5bebb0fad9
TrickBot
f18e37c957973e11af3e470a4ca4d350537ff72af51a01b02b8d45e5600b1e80
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rev3 banker trojan
Link:
https://tria.ge/reports/210318-e3qmv8ah36/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
761e4e0fcf790370a8d0f849b7948bf21a4b56d077369bfd58f162d11fb2458a
MD5 hash:
b3e0efb5ad3862be1c1486b17e29a3fe
SHA1 hash:
3873b5b1ab05421e7ba4e65bf12b07ab070dc03c
Link:
https://www.unpac.me/results/48764fcd-b00d-42ee-9dc0-a889195a2c5e/
SH256 hash:
a3d60fc4e0bea6f9b23c79febb4892d5918d7eeb2a3de12da2aa7ecf750e7b69
MD5 hash:
da4f34811fded32df289a81d0fe02d0f
SHA1 hash:
9a11799f95b233735396f18b903b19a1bca2c9cd
Link:
https://www.unpac.me/results/48764fcd-b00d-42ee-9dc0-a889195a2c5e/
SH256 hash:
340b9750c514396d6bf92f834571086b148e727d31772c562637dba122e9f339
MD5 hash:
004e7cfc1370b8d65f11772f90dd1e2a
SHA1 hash:
ac32f20b822c16c1df26b58db0e5bca3d171999a
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/48764fcd-b00d-42ee-9dc0-a889195a2c5e/
SH256 hash:
b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6
MD5 hash:
5bab87140fed67a1a1d4480753e68e46
SHA1 hash:
48a0c09f3659ed2ea2194eb03bbc79feab2b9c06
Link:
https://www.unpac.me/results/48764fcd-b00d-42ee-9dc0-a889195a2c5e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll b617b7dca180cf678066da3eff7c09d9f8d79a10b71a81cc8b8935cc978ec7c6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1074633/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/125420/

Comments