MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7
SHA3-384 hash: d8642edc3ca16645f6bf98e1821c7d5a4b383167bcc20103613a59905552b329f6d7e487960ff64cc88067e18966f62e
SHA1 hash: 2a85323d7a18f375490b4316743792356917336c
MD5 hash: 44669e0ff064dfc9e724391003dcde87
humanhash: georgia-alabama-romeo-four
File name:SecuriteInfo.com.Generic.mg.44669e0ff064dfc9.19862
Download: download sample
Signature TrickBot
Create hunting rule
File size:361'472 bytes
First seen:2021-02-15 23:55:58 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ee693e3bb4d5864fb5995225a53cea3c (3 x TrickBot)
ssdeep 6144:WFKu/DzWD+JOAQBHMa2Bgrc0P9eydIC5sCwllcQL727K7wbkQFV:WIckjAQGTCNP9vICCC2L729xV
TLSH 4F746D04B574051DDBA943B324ADBDC29A3966883FBCCB4F766D09DF0728933711BA92
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
183
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117258/
Detection(s):
SecuriteInfo.com.Generic.mg.44669e0ff064dfc9.19862.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/608538
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 353299 Sample: SecuriteInfo.com.Generic.mg... Startdate: 16/02/2021 Architecture: WINDOWS Score: 52 25 Multi AV Scanner detection for submitted file 2->25 27 Machine Learning detection for sample 2->27 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 regsvr32.exe 8->12         started        process5 14 iexplore.exe 2 71 10->14         started        process6 16 iexplore.exe 151 14->16         started        dnsIp7 19 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49743, 49744 YAHOO-DEBDE United Kingdom 16->19 21 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49745, 49746 FASTLYUS United States 16->21 23 10 other IPs or domains 16->23
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 20:55:59 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=x2lu4gwazabcjq25jglw5afsdxf5uki6n7bifnnke2xqcseop7lq._file
Verdict:
unknown
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon55 banker trojan
Link:
https://tria.ge/reports/210215-vjhd8rvf5n/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
194.5.249.156:443
142.202.191.164:443
193.8.194.96:443
45.155.173.242:443
108.170.20.75:443
185.163.45.138:443
94.140.114.136:443
134.119.186.202:443
200.52.147.93:443
45.230.244.20:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
Unpacked files
SH256 hash:
7de40a3b9a8143c5ac0f7dd4ed21117351d1bf0cd47865c91de4eeafb579db1d
MD5 hash:
85e491e18501f520ce93704e3fbcfdea
SHA1 hash:
625b3ac9afe183908d2003529e3fa0062a10bc1d
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6a2bf964-621f-4329-bbfe-abeb85ebe4d5/
Parent samples :
3a0bf36841aa0f458ef6310384e98f2c689f2a821be8bbe64ffaab1fbbb3187a
be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7
SH256 hash:
ebd0a930e9b27e94e50e65efd51ab69bc2a3fece46818385cc065580938608d3
MD5 hash:
ff197a2a73e4361c5c1efa21c491aa77
SHA1 hash:
9c2c3624597591803e310ae70a7705faecc927f0
Link:
https://www.unpac.me/results/6a2bf964-621f-4329-bbfe-abeb85ebe4d5/
SH256 hash:
be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7
MD5 hash:
44669e0ff064dfc9e724391003dcde87
SHA1 hash:
2a85323d7a18f375490b4316743792356917336c
Link:
https://www.unpac.me/results/6a2bf964-621f-4329-bbfe-abeb85ebe4d5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll be974e1ac0c80224c35d49976e80b21dcbda291e6fc282b5aa26af01488e7fd7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1011570/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/117258/

Comments