MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252
SHA3-384 hash: 66ef203787aa685b17cb7057cc3c5658b6bb2a60600ee43a82d589ff7c56d52f48045a6364348e5437fb640b216085f1
SHA1 hash: e65c7052e235e776cb9fbb8accef8d27e42f3b2c
MD5 hash: 584aa8473d873ecccb7601672550f4dc
humanhash: eleven-july-twenty-freddie
File name:584aa8473d873ecccb7601672550f4dc.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:429'056 bytes
First seen:2021-10-13 17:04:14 UTC
Last seen:2021-10-13 18:18:28 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dc56e072f32d1e6dbbad8cbe6ec04fdb (2 x TrickBot)
ssdeep 12288:izMrEY/8q9j0uOEcLmWtQqqCSoHhMVr9fC6n:Z/8e0vEcLmWKIwr9
Threatray 4'211 similar samples on MalwareBazaar
TLSH T1C994DF1232D0C032D26F26794862D3B16B6A7C709FB5978F3F94BE3E5E706904E28356
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197308/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.35922.5508.5812.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger packed trickbot
Link:
https://www.filescan.io/uploads/616711c21c2d58ba74050846/reports/34b6eb43-107b-4949-affd-411dcc0aaa62/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8dcd852c-d41d-4e9e-9bc2-e468418644d8
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/869879
Signature
Allocates memory in foreign processes
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 502308 Sample: M1YceQ237E.dll Startdate: 13/10/2021 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->57 59 Found malware configuration 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Yara detected Trickbot 2->63 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        process3 signatures4 73 Writes to foreign memory regions 8->73 75 Allocates memory in foreign processes 8->75 13 regsvr32.exe 8->13         started        16 cmd.exe 1 8->16         started        18 rundll32.exe 8->18         started        20 3 other processes 8->20 process5 signatures6 77 Hijacks the control flow in another process 13->77 79 Writes to foreign memory regions 13->79 81 Allocates memory in foreign processes 13->81 83 Queues an APC in another process (thread injection) 13->83 22 wermgr.exe 13->22         started        26 cmd.exe 13->26         started        85 Early bird code injection technique detected 16->85 28 rundll32.exe 16->28         started        30 wermgr.exe 18->30         started        32 cmd.exe 18->32         started        34 iexplore.exe 2 153 20->34         started        process7 dnsIp8 43 105.27.205.34, 443, 49868, 50031 SEACOM-ASMU Mauritius 22->43 45 181.129.167.82, 443, 49795, 49801 EPMTelecomunicacionesSAESPCO Colombia 22->45 53 4 other IPs or domains 22->53 65 Tries to detect virtualization through RDTSC time measurements 22->65 67 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 22->67 69 Writes to foreign memory regions 28->69 71 Allocates memory in foreign processes 28->71 36 wermgr.exe 28->36         started        39 cmd.exe 28->39         started        47 46.99.175.149, 443, 49796, 50021 IPKO-ASAL Albania 30->47 49 192.168.2.1 unknown unknown 30->49 51 cm.g.doubleclick.net 172.217.168.2, 443, 49819, 49822 GOOGLEUS United States 34->51 55 24 other IPs or domains 34->55 signatures9 process10 dnsIp11 41 65.152.201.203, 443, 49794, 50020 CENTURYLINK-US-LEGACY-QWESTUS United States 36->41
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252/
Threat name:
Win32.Trojan.TrickBotCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-13 13:57:21 UTC
AV detection:
16 of 45 (35.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=amcp4l24xla4yltzxw6i3kryetlkr2ytt5gvx3d3k42yzvg6qjja._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
26a6d15bb16939076bf726e4e573b2519f7fa222c35a3b5361d9c208a10b284b
TrickBot
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
TrickBot
5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49
TrickBot
61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e
TrickBot
cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
+ 4'201 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:sat4 banker suricata trojan
Link:
https://tria.ge/reports/211013-vlv2caeeap/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
c75a2d2908cd025a4f42a7457f56254915fb5108a8a572ea26409f71f2264277
MD5 hash:
3cbb6d834785239e1881d5420b20d44c
SHA1 hash:
f8f98977383b7569ff4d8d6d8f739f4139c61445
Link:
https://www.unpac.me/results/0b11ae75-2897-4ed0-857e-92cccea5b627/
SH256 hash:
1a31a3f2791caf6215b89564659049ef4f10d21e9fc7d3417f758d5552c62686
MD5 hash:
bdd0e6a169c8bea1febf45e410a8885f
SHA1 hash:
e4752d902c00e782520425c8a6f56866ee616515
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0b11ae75-2897-4ed0-857e-92cccea5b627/
SH256 hash:
2a79f17fea09e493b1afdc80f2299c8190f93fc1945f4b32699980096f0050af
MD5 hash:
406622a640dd5c4ace001b1736d02514
SHA1 hash:
5f3450301d39b7698f300da901e03832ea34c66e
Link:
https://www.unpac.me/results/0b11ae75-2897-4ed0-857e-92cccea5b627/
SH256 hash:
a615a7e017ab0b6b36e3f0e1a9061c60b70cb1ed946de71b095c469a7ac47001
MD5 hash:
b790a892df9cfedf7926934a42b17752
SHA1 hash:
5c14f94e6ee54344f89636f8bef6d422d2abdbc2
Link:
https://www.unpac.me/results/0b11ae75-2897-4ed0-857e-92cccea5b627/
SH256 hash:
0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252
MD5 hash:
584aa8473d873ecccb7601672550f4dc
SHA1 hash:
e65c7052e235e776cb9fbb8accef8d27e42f3b2c
Link:
https://www.unpac.me/results/0b11ae75-2897-4ed0-857e-92cccea5b627/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0304fe2f5cba/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/197308/
  
URLhaus
https://urlhaus.abuse.ch/url/1673873/
  
Delivery method
Distributed via web download

Comments