MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db
SHA3-384 hash: 11753072d5dad0b690abddc121ade8aed347763bbb557d9cea5a9d5e9245209d248753ed9f7204fe77a69e0ed3c73382
SHA1 hash: 51b17236d40ef2c354916d6f758191b3128bf58d
MD5 hash: 75378e60ba4f150d6adb5468edef655b
humanhash: green-august-march-foxtrot
File name:mon102.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:602'112 bytes
First seen:2021-03-03 23:33:07 UTC
Last seen:2021-03-04 08:15:25 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 797384ad59f07b968b9c5c867c00b02f (3 x TrickBot)
ssdeep 12288:N7fcBXTEC7wfnmB/fjOFSd20Kdo1Ky+rMOW1wA86SzEkNtEQFB:oEC7h8u2xdo1Ky+gpBWzZ3FB
Threatray 2 similar samples on MalwareBazaar
TLSH F9D4CF13B6E28135E5AF02343E656B79A2FDFA509DF6C68777C0CA1C5D31A01CA1632B
Reporter Cryptolaemus1
Tags:dll mon102 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122130/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.12251.22480.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
6 / 100
Link:
https://www.joesandbox.com/analysis/626994
Behaviour
Behavior Graph:
n/a
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 23:34:05 UTC
File Type:
PE (Dll)
Extracted files:
26
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=75svjkzh7iummavn2dciestfdnbpbwnulz6qu5mluzxc4ziftdnq._file
Verdict:
malicious
Similar samples:
4753a98480bfe6aa5685edb0456642679f4e49cdf94724151f53a191a75811db
TrickBot
c486a02bb56748a663dfcfca68847f33c93574aaba9d326685129d7b664abbb5
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon102 banker trojan
Link:
https://tria.ge/reports/210303-7ctjkdz7xx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
30928418e780f5a2ffce6e4e00d637faf1da9135043c9dd6ff36a7e41ae47a99
MD5 hash:
d20aef24522d4da1f9aa6c2bb8d2ac50
SHA1 hash:
e2221f3ad963bd2bd0f210f59fc5f9dbd1ca8897
Link:
https://www.unpac.me/results/45f2c937-4553-4c8e-a757-536ab482838c/
SH256 hash:
3a95a9a32c478c795760bb027f1a286b5cee37059dab71c31e0001ab8d45833b
MD5 hash:
dd1d4089e107eefe2c27be4e1f7f4f97
SHA1 hash:
ab934b56c4a391928304b5c3ef9ade98d3cf8c1d
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/45f2c937-4553-4c8e-a757-536ab482838c/
Parent samples :
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db
c826f15397da6524595b08d710f4d69a18ea5870c5ef4029b20988987461aeb0
SH256 hash:
2a280be8eccc134f735f2d1a6e46c880f4087c8a2d34b84e54ff3ca88cb32c14
MD5 hash:
ef71da5cc81c6971d49d98e32c4b28b8
SHA1 hash:
6c42fa3d5841662551e7581824f2d0eb6f9ea82d
Link:
https://www.unpac.me/results/45f2c937-4553-4c8e-a757-536ab482838c/
SH256 hash:
ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db
MD5 hash:
75378e60ba4f150d6adb5468edef655b
SHA1 hash:
51b17236d40ef2c354916d6f758191b3128bf58d
Link:
https://www.unpac.me/results/45f2c937-4553-4c8e-a757-536ab482838c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/ff6554ab27fa28c602add0c4824a651b42f0d9b45e7d0a758ba66e2e650598db

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/122130/
  
URLhaus
https://urlhaus.abuse.ch/url/1045309/

Comments