MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb
SHA3-384 hash: 06461f9737983e5dacbf60e05d43498089cc970ec383e23637ade796689a53fa72a4a0cdf09951754a17b3491ae07ae3
SHA1 hash: f0fcb980a3d13b3aae0c6059e9a83a700af72978
MD5 hash: 3a35cdd69dbafa00b86e274c03444a49
humanhash: october-fish-mango-music
File name:SecuriteInfo.com.ML.PE-A.2715.22369
Download: download sample
Signature TrickBot
Create hunting rule
File size:622'592 bytes
First seen:2021-03-16 19:48:43 UTC
Last seen:2021-04-01 02:42:59 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 3bf893761e37a67bd8b3cc12a37692d9 (1 x TrickBot)
ssdeep 6144:CdVreYRzK1L7g+3BCebsL5utzT1lTWYYgGcnbAPp5yTlPMie3uuK5pUXk/:CPBCL7NgewKZlqyAhoTxMie3Zu2
Threatray 7 similar samples on MalwareBazaar
TLSH 81D4DF5275E1C075CAEE07301A699B3463FDFD505E71C18BF782BBAC5D339418A2AB22
Reporter SecuriteInfoCom
Tags:bfdnews.xyz TrickBot

Intelligence

File Origin
# of uploads :
4
# of downloads :
342
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/124447/
Detection(s):
SecuriteInfo.com.ML.PE-A.2715.22369.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/13057745-3485-4914-b34f-f261f30d40a3
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/641352
Signature
Multi AV Scanner detection for submitted file
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 369650 Sample: SecuriteInfo.com.ML.PE-A.27... Startdate: 16/03/2021 Architecture: WINDOWS Score: 56 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected Trickbot 2->31 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 17 8->12         started        14 regsvr32.exe 8->14         started        process5 16 iexplore.exe 2 71 10->16         started        18 cmd.exe 12->18         started        process6 20 iexplore.exe 152 16->20         started        dnsIp7 23 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49716, 49717 YAHOO-DEBDE United Kingdom 20->23 25 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49710, 49711 FASTLYUS United States 20->25 27 10 other IPs or domains 20->27
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 19:49:05 UTC
File Type:
PE (Dll)
Extracted files:
22
AV detection:
12 of 47 (25.53%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=znwswwukimwjhirwyqetneuvfzq6gmr7wc5jpeey2go5nvtq7hfq._file
Verdict:
malicious
Similar samples:
2eaa196b5f4f0d20b23dd82f001f369e05de803834a11cfe93dd7b795d9e6cd2
TrickBot
4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db
TrickBot
9f46729f68497f8aa905e1f8ed3d197d5924a8d7acee4813b1549e6ede0cc6a8
TrickBot
a007bf2037c97f6f4a9c19502c0403b36e02b0c657ab152a661d250a3957fc74
TrickBot
b1059d3901d7ddbd8bae644b5c5293579fa6f52eb67949d0f259f414ddb48881
TrickBot
c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
TrickBot
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon142 banker trojan
Link:
https://tria.ge/reports/210316-js1lcel2wj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
c558bbf0f04410a9c1e80dd86e93bf21774b0d9c13f55b8beb6a5f88446c20ce
MD5 hash:
366271865b3ce5dc127e61fd925d07ab
SHA1 hash:
1a53f737ae11427b80caede3fd37ea18c07e1b5c
Link:
https://www.unpac.me/results/6cc0894f-fb2b-43b4-a2f1-0a6745ee22b3/
SH256 hash:
0ed27e9489dd3d96d704e06a0d5fbf67ffd79148a728a99b540821b9af6bb034
MD5 hash:
5b5a81913fddea9e639282f297c0043f
SHA1 hash:
a812259233e85a47c2a1ebbc192172cc79a53407
Link:
https://www.unpac.me/results/6cc0894f-fb2b-43b4-a2f1-0a6745ee22b3/
SH256 hash:
fc5cb3ac1784cb3dd4134668f7b438bcdc049fe7b667e721c5c19ff95eb5404f
MD5 hash:
5a814c68aba17394fd53187c97b1edf7
SHA1 hash:
ca597a37af9b9c093d304f7f89d8f6c34e56bb93
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6cc0894f-fb2b-43b4-a2f1-0a6745ee22b3/
SH256 hash:
cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb
MD5 hash:
3a35cdd69dbafa00b86e274c03444a49
SHA1 hash:
f0fcb980a3d13b3aae0c6059e9a83a700af72978
Link:
https://www.unpac.me/results/6cc0894f-fb2b-43b4-a2f1-0a6745ee22b3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll cb6d2b5a8a432c93a236c4093692952e61e3323fb0ba979098d19dd6d670f9cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1071381/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1071466/
Cape
Cape
https://www.capesandbox.com/analysis/124447/
  
URLhaus
https://urlhaus.abuse.ch/url/1072001/
  
URLhaus
https://urlhaus.abuse.ch/url/1072002/

Comments