MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
SHA3-384 hash: d334550dc6f1978dcb635d7e3c1bc264f55053f84f0e41b585d9bcc2907779dd9781fb8729462aaf781ba428cfd1c76d
SHA1 hash: d33987029a6fe5db194e514ace1d7fac79351d2f
MD5 hash: d2ff4ec608af9d59457d6739857fb42e
humanhash: william-bluebird-fruit-georgia
File name:m105.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:602'112 bytes
First seen:2021-03-03 23:07:00 UTC
Last seen:2021-03-04 08:15:14 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 797384ad59f07b968b9c5c867c00b02f (3 x TrickBot)
ssdeep 12288:z7fcBXTEC7wfnmB/fjOFS54qbNNqtskGjclmQvoZ1EQFB:mEC7h844INcSkyclkRFB
TLSH 4AD4CF13B6E2C136D5AF02343E656B79A2FDF9609DF2C68777C0CA1C9D31941CA1632A
Reporter James_inthe_box
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
4
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122128/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.12251.22480.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/626969
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 362465 Sample: m105.dll Startdate: 04/03/2021 Architecture: WINDOWS Score: 48 32 Multi AV Scanner detection for submitted file 2->32 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 20 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 1 73 10->16         started        19 wermgr.exe 12->19         started        dnsIp6 24 192.168.2.1 unknown unknown 16->24 21 iexplore.exe 155 16->21         started        process7 dnsIp8 26 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49750, 49751 FASTLYUS United States 21->26 28 geolocation.onetrust.com 104.20.185.68, 443, 49735, 49736 CLOUDFLARENETUS United States 21->28 30 8 other IPs or domains 21->30
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 23:06:28 UTC
File Type:
PE (Dll)
Extracted files:
26
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysdkak5vm5ekmy67z7fgrbd7gpetk5fkxkotezufckoxwzskxo2q._file
Verdict:
malicious
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon105 banker trojan
Link:
https://tria.ge/reports/210303-c4yxwjdpse/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
61f0340cebc54247b62e6af0713f5793e6c7ba73bffd01a5763af6f5fdd96c3b
MD5 hash:
c78d218e7394bda271f65100f0f28f05
SHA1 hash:
9fc805d7ae14460fe5e81484e56ba1176bf4649d
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e4a39131-d7de-4258-8d3c-3766eb26a00c/
Parent samples :
c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
038d131f77ce33aa98935bef9318d310ec141e3c0db0b84e4b4679d8a6665151
SH256 hash:
ee6eca6da621682747684a6598d34f21041b74cd54cc299a6dd0a87a4b4e59a5
MD5 hash:
2810ea8b2ff45d7be1b0b229219d85d4
SHA1 hash:
b55f5481549874ade1e051b91aa333cee6491e37
Link:
https://www.unpac.me/results/e4a39131-d7de-4258-8d3c-3766eb26a00c/
SH256 hash:
b721ac3f17dd8ac2d56aee56f2b80c5b3a435b55d80ecb1def13518a0e1476d7
MD5 hash:
f33b12558cf760252114b3c28a245bf0
SHA1 hash:
d61033c01ee93cface0fd66a945aa95e9bd8d32e
Link:
https://www.unpac.me/results/e4a39131-d7de-4258-8d3c-3766eb26a00c/
SH256 hash:
c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
MD5 hash:
d2ff4ec608af9d59457d6739857fb42e
SHA1 hash:
d33987029a6fe5db194e514ace1d7fac79351d2f
Link:
https://www.unpac.me/results/e4a39131-d7de-4258-8d3c-3766eb26a00c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/122128/
  
URLhaus
https://urlhaus.abuse.ch/url/1045268/
  
URLhaus
https://urlhaus.abuse.ch/url/1045288/

Comments