🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
SHA3-384 hash: 1f950b1dbb3bd76264a20d83625ecd9cd12c2c367efc3fdccef0fa4089ce789945dcae8c0dbf39f357b2a4899b2ee1f9
SHA1 hash: 0c4572af283c893d87c6040b795150ab55ec0577
MD5 hash: 4e6ac23cf16f054b9b79ccbe0e486f82
humanhash: december-nevada-october-berlin
File name:dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
Download: download sample
Signature TrickBot
Create hunting rule
File size:306'688 bytes
First seen:2021-07-26 19:47:18 UTC
Last seen:2021-07-26 20:44:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fa9122e88b3229bd962b738364554370 (1 x TrickBot, 1 x AnchorDNS)
ssdeep 6144:rTW3YgVzMS73tzrVmSavGXQ+90sGjGms4+/NoNZra8dOJCUJUeANlq:rTW3YmzMc3tzrVmLvGA5sGimst/NQ/U7
Threatray 8 similar samples on MalwareBazaar
TLSH T14C648D06AB988A79E4BB42FBCE574503D6B6B80147B0C6AF1FE406653F33760962DF11
Reporter Anonymous
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
Verdict:
No threats detected
Analysis date:
2021-07-26 19:50:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/854aa736-b095-4db7-b0c6-28504d1f3a4c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174200/
Detection(s):
SecuriteInfo.com.Variant.Bulz.366354.8864.22304.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ff7e497b-0565-4f64-8a9a-bc15e5fbac25
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/821984
Signature
Antivirus / Scanner detection for submitted sample
Creates files in alternative data streams (ADS)
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 454396 Sample: 5h16KQ1k6w Startdate: 26/07/2021 Architecture: WINDOWS Score: 80 34 hdspread.com 2->34 36 checkip.us-east-1.prod.check-ip.aws.a2z.com 2->36 38 2 other IPs or domains 2->38 46 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 May check the online IP address of the machine 2->52 8 loaddll64.exe 1 2->8         started        10 rundll32.exe 1 2->10         started        14 rundll32.exe 2->14         started        16 rundll32.exe 2->16         started        signatures3 process4 dnsIp5 18 rundll32.exe 2 8->18         started        22 cmd.exe 1 8->22         started        24 rundll32.exe 8->24         started        26 2 other processes 8->26 40 hdspread.com 10->40 42 checkip.us-east-1.prod.check-ip.aws.a2z.com 34.202.33.33, 49715, 80 AMAZON-AESUS United States 10->42 44 2 other IPs or domains 10->44 60 System process connects to network (likely due to code injection or exploit) 10->60 signatures6 process7 file8 30 C:\Users\user\...\5h16KQ1k6w.dll:  $TASK, ASCII 18->30 dropped 32 C:\Users\user\...\5h16KQ1k6w.dll:  $FILE, ASCII 18->32 dropped 54 System process connects to network (likely due to code injection or exploit) 18->54 56 Creates files in alternative data streams (ADS) 18->56 58 May check the online IP address of the machine 18->58 28 rundll32.exe 22->28         started        signatures9 process10
Gathering data
Threat name:
Win64.Trojan.Trickster
Create hunting rule
Status:
Malicious
First seen:
2021-07-26 19:48:04 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3lulk3sx2efvidawmtecj7qn7nrrnkg64bzc2hkxw6lbcr6nqv6a._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
024d1e75caece924601857b3e631b56936784215267c89d4ebc20f32258fa689
TrickBot
04b98d8945035c6b92d1bc4126727d6b2c26ce78d0d76ef314f96bfd7a72aa20
TrickBot
09e3570fe057bd4931487abc899f3ce06e3c48aa7e248d83fa9580003b0eac32
TrickBot
1455554d5585f68ec7212a6fca985aa7e3bb1904fce6dcfbb9a0b26751cbd23e
TrickBot
348c1970f3ce0b20eda196db27b3596864d8e99bedf575855aa35f5b5f5fc084
TrickBot
6705e047fa428a99d0fe1d4b14aca448400981eaf3f24b0d0c10b7b4761e1a19
TrickBot
67e88a34b883c76e3002f09b021177554a51808c1d6a9e9ece620562d14b0d2f
TrickBot
9aa0f2a8b7cf8b2943a8d95a4808170aeae514e14cd318f5e8ab200e6e846838
TrickBot
Result
Malware family:
anchordns
Create hunting rule
Score:
  10/10
Tags:
family:anchordns backdoor
Link:
https://tria.ge/reports/210726-zbzfb6mh82/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Unpacked files
SH256 hash:
dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c
MD5 hash:
4e6ac23cf16f054b9b79ccbe0e486f82
SHA1 hash:
0c4572af283c893d87c6040b795150ab55ec0577
Detections:
win_anchor_a0
Create hunting rule
Link:
https://www.unpac.me/results/5052ef05-299f-44f4-bcf9-a06f0e659359/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dae8b56e57d10b540c1664c824fe0dfb6316a8dee0722d1d57b7961147cd857c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/174200/

Comments