MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70
SHA3-384 hash: 30093c27afec1bb4a589ee7c5764dbec5e2ae670e9b2456c6c414a9de382c9fe36cc20aaa886ade2f232e3362acebd7b
SHA1 hash: 13019bf341f28165f6e4729a7d76ec4f3eab1ad6
MD5 hash: 7e09c3d9ee6e83e7b6de694c4f72e129
humanhash: steak-harry-robert-emma
File name:mon94.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:1'085'516 bytes
First seen:2021-03-02 09:55:26 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash d32b4b1906fa2ea31b12c4d6e80d5b9d (3 x TrickBot)
ssdeep 12288:Xhm3t/45Iz5tby4y9MZTESoqISd6hPbuotFb3Z7wmjy:x+/4YFTESnsPn37Ny
TLSH 4F352926B170C435D3B95230CD95AEAC72E6AC718F6429D376407B8E7A3AAD1C635333
Reporter JAMESWT_WT
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/120904/
Detection(s):
SecuriteInfo.com.ArtemisC0380891E177.22410.10729.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/623593
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 360782 Sample: mon94.dll Startdate: 02/03/2021 Architecture: WINDOWS Score: 48 27 Multi AV Scanner detection for submitted file 2->27 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 regsvr32.exe 8->12         started        14 rundll32.exe 8->14         started        process5 16 iexplore.exe 2 84 10->16         started        process6 18 iexplore.exe 5 153 16->18         started        dnsIp7 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49726, 49727 FASTLYUS United States 18->21 23 geolocation.onetrust.com 104.20.184.68, 443, 49712, 49713 CLOUDFLARENETUS United States 18->23 25 9 other IPs or domains 18->25
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-02 07:42:10 UTC
File Type:
PE (Dll)
Extracted files:
118
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgped37rerto5r6wt3mucvvzukp57lnrbdxacam4ewfggh5nvrya._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210302-zqf4fsy9te/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70
MD5 hash:
7e09c3d9ee6e83e7b6de694c4f72e129
SHA1 hash:
13019bf341f28165f6e4729a7d76ec4f3eab1ad6
Link:
https://www.unpac.me/results/c6c0bfb5-2b99-45ee-9f30-a8f892efcc4b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll b99e41eff12466eec7d69ed94156b9a29fdfadb108ee01019c258a631fadac70

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/120904/
  
URLhaus
https://urlhaus.abuse.ch/url/1041770/
  
Delivery method
Distributed via web download

Comments