🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf0de0c3ff0e337e47088e11c0867dda9709eaafa0a1c095c132e9b87722158e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf0de0c3ff0e337e47088e11c0867dda9709eaafa0a1c095c132e9b87722158e
SHA3-384 hash: e6a0ed084ff18c0bc21e5d4a735a0880774de13cee07b0d8ed80cc6911ba476068fd3f1bba4822700f58922739e6b567
SHA1 hash: 7b811d26a4852b9d564c4dab878bd672bbbe7078
MD5 hash: 843f6c0c24bfc31b6a19471935a092da
humanhash: high-delaware-mobile-juliet
File name:prescribe .07.21.doc
Download: download sample
Signature TrickBot
Create hunting rule
File size:89'576 bytes
First seen:2021-07-15 12:27:44 UTC
Last seen:2021-07-15 16:53:41 UTC
File type:Word file doc
MIME type:text/xml
ssdeep 1536:EVHB5EfbL5A3S9Hr11AQYyqGJHQYCDEtU6dLTR97iQ3:AUfbL5iSDxQYNtU6Zvi4
TLSH T10893C673FE8998DFC583E0B6174A757B4D677637B1CA21AC10CA6114C3D18D7A7A280B
Reporter MLParker1
Tags:TrickBot


Avatar
MLParker1
Current zip pass: 436436

Intelligence

File Origin
# of uploads :
3
# of downloads :
336
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
request.zip
Verdict:
Malicious activity
Analysis date:
2021-07-15 12:24:02 UTC
Tags:
trojan
Link:
https://app.any.run/tasks/37c8386b-b1a1-41de-a634-5d0281d8dda6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/msword
Has a screenshot:
False
Contains macros:
True
Detection(s):
SecuriteInfo.com.ISB.Downloadergen148.486.15552.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/816904
Signature
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (process start blacklist hit)
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: MSHTA Spawning Windows Shell
Sigma detected: Register DLL with spoofed extension
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 449315 Sample: prescribe .07.21.doc Startdate: 15/07/2021 Architecture: WINDOWS Score: 84 24 Multi AV Scanner detection for submitted file 2->24 26 Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros) 2->26 28 Sigma detected: Register DLL with spoofed extension 2->28 30 5 other signatures 2->30 8 WINWORD.EXE 38 41 2->8         started        process3 file4 20 C:\Users\user\...\prescribe .07.21.doc.LNK, MS 8->20 dropped 11 cmd.exe 2 2 8->11         started        process5 process6 13 mshta.exe 1 22 11->13         started        16 conhost.exe 11->16         started        dnsIp7 22 airloweryd.com 45.153.230.151, 49707, 80 TEAM-HOSTASRU Russian Federation 13->22 18 regsvr32.exe 13->18         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf0de0c3ff0e337e47088e11c0867dda9709eaafa0a1c095c132e9b87722158e/
Threat name:
Script.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 12:28:07 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev1 banker trojan
Link:
https://tria.ge/reports/210715-klrh7ca4yx/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Process spawned unexpected child process
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf0de0c3ff0e337e47088e11c0867dda9709eaafa0a1c095c132e9b87722158e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Word file doc cf0de0c3ff0e337e47088e11c0867dda9709eaafa0a1c095c132e9b87722158e

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments