MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb1ef8c3a4792e314a4a22711c8a3fd359d24f3c154cd933f756c812713186a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Intelligence 1 File information 1 Yara Comments

SHA256 hash: cb1ef8c3a4792e314a4a22711c8a3fd359d24f3c154cd933f756c812713186a5
SHA3-384 hash: d89913767cd4324deaac967c6183596f94f57f0c07c6fb20101eb8463402f97362b0ac1239136d31cbd721ed1a7824e1
SHA1 hash: 330f2e36c6543bd5b17580dcdbf333e87cd92a74
MD5 hash: 9985e30d0c6a85362f52ce76527f4012
humanhash: connecticut-cold-football-blue
File name:update.dll
Download: download sample
Signature TrickBot
File size:683'520 bytes
First seen:2020-07-01 01:12:07 UTC
Last seen:2020-07-01 02:05:20 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e2f96fb1ec05e67a1aab8c3377fed22b
ssdeep 12288:m7cmeYTWJ/Vm3jn+2OLE5gWk3uKBpIAf4CHEv6I:9YqJijuw5NKBVRH2
TLSH C4E4F6B70D31F025D96E1537FA89C7D23B2F9C90C711CACB668A01EE9A58DC6853532B
Reporter @malware_traffic
Tags:dll TrickBot

Intelligence


Mail intelligence No data
# of uploads 2
# of downloads 34
Origin country US US
CAPE Sandbox Detection:TrickBot
Link: https://www.capesandbox.com/analysis/18138/
ClamAV PUA.Win.Downloader.Aiis-6803892-0
CERT.PL MWDB Detection:trickbot
Link: https://mwdb.cert.pl/sample/cb1ef8c3a4792e314a4a22711c8a3fd359d24f3c154cd933f756c812713186a5/
ReversingLabs :Status:Malicious
Threat name:Win32.Trojan.Trickbot
First seen:2020-07-01 01:14:04 UTC
AV detection:20 of 31 (64.52%)
Threat level:   5/5
Spamhaus Hash Blocklist :Malicious file
Hatching Triage Score:   10/10
Malware Family:trickbot
Link: https://tria.ge/reports/200701-8axzpphkss/
Tags:trojan banker family:trickbot
Config extraction:95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
VirusTotal:Virustotal results 5.63%

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments