MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01
SHA3-384 hash: cfd7f5bd3736d6a59a13de34dfdaeb87712dd9492f4e7e6ab2a01118590a159d48ba9c9dbefbad78dc0e03b7dd65694a
SHA1 hash: 097cc2d70de1779e76b76e32e4fd043cf31498b2
MD5 hash: b7e359f7786b76b7657659e7a6f12a5f
humanhash: fifteen-harry-michigan-magnesium
File name:pic.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:344'064 bytes
First seen:2020-12-28 17:22:45 UTC
Last seen:2020-12-28 18:54:33 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 2a9b446f7a4dc4fb7e912c8b845b8d52 (1 x TrickBot)
ssdeep 6144:ges7FB/0v3sKYsdvWPmv7pydfo/LZmurlV6S9+fcuM1a:gF7IFd+PmTsdf6ZHV6Scfcuca
Threatray 2'936 similar samples on MalwareBazaar
TLSH 3C74F0023186C4B2F15E417F4805C3A6177B34B19F78AAC7BFC1569E8B3A5D69E36382
Reporter abuse_ch
Tags:dll rob32 TrickBot


Avatar
abuse_ch
Malspam distributing TrickBot:

HELO: email.pioneeracademics.com
Sending IP: 212.146.220.138
From: Customer Service <techsupport@pioneeracademics.com>
Reply-To: Customer Service <admissions1@pioneeracademics.com>
Subject: Staffing Update xxx xxx
Attachment: Document_xxx.zip (contains "Document_xxx.xlsm")

TrickBot payload URL:
http://vermapaints.com/pic.gif

TrickBot C2s:
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449

Intelligence

File Origin
# of uploads :
2
# of downloads :
394
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/109757/
Detection(s):
SecuriteInfo.com.Generic.mg.b7e359f7786b76b7.7682.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Sending a UDP request
Sending a custom TCP request
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
7 / 100
Link:
https://www.joesandbox.com/analysis/570875
Behaviour
Behavior Graph:
n/a
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-12-28 17:23:04 UTC
AV detection:
8 of 28 (28.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6puloqqf2pp2ic34mgh6l56samnnwzzc7liuy2sykf6qx6d4piaq._file
Verdict:
malicious
Similar samples:
1b70916e2d3e600ed8f1bb48d9b784669e5c77b9129befb0609425f91880192c
TrickBot
4acc4f2470a14360417676e816b24e0271638410112b7068b3c822db522b5e2b
TrickBot
5abc66f1c2e2fb7c2d74dbaa17cfa47b1a4f4fc576ef7c842bc1de10bf236e5e
TrickBot
5c8356172fa558970b2136a5284da800910c0fef74a75a7eb160874ed3edeec2
TrickBot
a46867b0d1a681e81886d2ab962209d39d36aa701cdff18b20159a93db40f1ec
TrickBot
b917f1d2b3e003cf83fc2a16e25481c1f4cc12d83b9c5879b98744e4a6ff220e
TrickBot
d194034aea6b209fdb3c39cbe12aa0ce42143ba06e855df83b1f8848f1738acf
TrickBot
f3d2c3f97d52b31f00be046d39ae0ff4dbee7f42c32cbddfca7d613dbb9fb6f3
TrickBot
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350
TrickBot
fbb4e4339bbb0bce98f6de368a927d77cfcd15067f178d80f626da35f9a08981
TrickBot
+ 2'926 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob32 banker trojan
Link:
https://tria.ge/reports/201228-hca2krrcae/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
41.243.29.182:449
196.45.140.146:449
103.87.25.220:443
103.98.129.222:449
103.87.25.220:449
103.65.196.44:449
103.65.195.95:449
103.61.101.11:449
103.61.100.131:449
103.150.68.124:449
103.137.81.206:449
103.126.185.7:449
103.112.145.58:449
103.110.53.174:449
102.164.208.48:449
102.164.208.44:449
Unpacked files
SH256 hash:
f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01
MD5 hash:
b7e359f7786b76b7657659e7a6f12a5f
SHA1 hash:
097cc2d70de1779e76b76e32e4fd043cf31498b2
Link:
https://www.unpac.me/results/0d2d6ebb-8c25-4c10-9ad9-af7f21f33202/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

zip 360bf54cf443450166ed5927ad05d37e93e3989af5d0460177b694277901e6ad

TrickBot

Excel file xlsm 6fb3d68ea64e29b3304a3885fb1ef3b3fffa27b2ce89ad40afcdda9572d8dcfe

TrickBot

DLL dll f3e8b74205d3dfa40b7c618fe5f7d2031adb6722fad14c6a58517d0bf87c7a01

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/943782/
  
Dropped by
SHA256 6fb3d68ea64e29b3304a3885fb1ef3b3fffa27b2ce89ad40afcdda9572d8dcfe
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/109757/

Comments