MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f894a027474fa36723db3644d7dc1715dbfd6db1dd18b1f124cf8abb8709e1f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

TrickBot

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	f894a027474fa36723db3644d7dc1715dbfd6db1dd18b1f124cf8abb8709e1f8
SHA3-384 hash:	dec7e84886052d5b01499b1657ee4f0d131d765ed6935453ce623f405a5f4b4d7d7379b90dcaa0c1f5d24c2cd889f5f1
SHA1 hash:	2daff152cecad77f3a1e5e1d43ee07376fccdabe
MD5 hash:	2e92d20d2ad68d9bd5841910c488af6e
humanhash:	coffee-march-magazine-fourteen
File name:	2e92d20d2ad68d9bd5841910c488af6e.dll
Download:	download sample
Signature	TrickBot Create hunting rule
File size:	1'821'184 bytes
First seen:	2021-12-09 16:17:36 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	c131e7ab95b6cc6ff4c2379d5b0fc4ad (3 x TrickBot)
ssdeep	1536:sjkUHInOKVU9vFhgD6wK1LhsfAWs/g9UhwtV/IeQ/HQljEqt:sjFiDgL+C/3hwXfuwJt
TLSH	T1C38535F1DBDA8B5FACCC986163020A7A51CA07678D45879AD0BC53FC787D982CC6BC52
Reporter	abuse_ch
Tags:	dll TrickBot

Intelligence

File Origin

# of uploads :

# of downloads :

900

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/212936/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

DNS request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/61b22c3f47ed217c01375f9a/reports/c52cb3ae-c421-432e-9858-4fcfecf29f61/overview

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6404f9f0-d11f-4efa-af7d-ebdbab4fae1b

Result

Threat name:

Unknown

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/904827

Behaviour

Behavior Graph:

n/a

Detection:

trickbot

Link:

https://mwdb.cert.pl/sample/f894a027474fa36723db3644d7dc1715dbfd6db1dd18b1f124cf8abb8709e1f8/

Threat name:

Win32.Trojan.CobaltStrike

Status:

Malicious

First seen:

2021-12-09 16:18:12 UTC

File Type:

PE (Sys)

AV detection:

26 of 28 (92.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ckkaj2hj6rwoi63gzcnpxaxcxn723nr3umld4jez6flxbyj4h4a._file

Verdict:

malicious

Result

Malware family:

trickbot

Score:

10/10

Tags:

family:trickbot botnet:rob142 banker trojan

Link:

https://tria.ge/reports/211209-tryhzscfe2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Looks up external IP address via web service

Trickbot

Malware Config

C2 Extraction:

181.129.85.98:443
189.112.119.205:443
189.51.118.78:443
186.121.214.106:443
49.176.188.184:443
61.69.102.170:443
213.32.252.221:443
89.46.216.2:443
103.36.79.3:443
103.108.97.51:443
95.140.217.242:443
41.175.22.226:443
190.109.169.161:443
186.159.12.18:443
190.109.171.17:443
181.196.148.202:443
186.47.75.58:443
186.42.212.30:443
190.214.21.14:443
187.108.32.133:443
201.184.226.74:443
186.159.5.177:443