🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
SHA3-384 hash: 4d3aa19f4c64b1da2833b4b2db25f3192ad55daa96f8f8bd3932b822dddece0be759491ad7cd17e559289ae93deaed0c
SHA1 hash: 0b4d212ac06d26e3fbb7365322d4cb7c5487444b
MD5 hash: d342499ba2e3adab152c4c7ed9ead426
humanhash: robert-hotel-south-nevada
File name:caDeEx.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:577'666 bytes
First seen:2021-09-13 22:14:54 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2447835d91955d5899b703294ffbcca5 (5 x TrickBot)
ssdeep 12288:5YzxeJ5ui1dZLGCD8atyw1L5+xWQaO76Ek:5weTuqrLGK0I9AasG
Threatray 3'420 similar samples on MalwareBazaar
TLSH T1D6C4CF0236E1C47AC5EE273459A35B1932F9FC114A76C287A745FA4E5E333C29C3A35A
dhash icon 0000000000000000 (907 x AgentTesla, 573 x Formbook, 316 x RedLineStealer)
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot


Avatar
malware_traffic
Run method: regsvr32.exe [filename]

Intelligence

File Origin
# of uploads :
1
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187591/
Detection(s):
SecuriteInfo.com.ML.PE-A.4317.22281.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/6175068a9a5a1e91c5d1fe53/reports/14bd9e63-39e8-4d1a-8dca-9f119946c5e2/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cf6a08a1-96bc-449d-b765-c22494128590
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/850237
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 482664 Sample: caDeEx.jpg Startdate: 14/09/2021 Architecture: WINDOWS Score: 100 71 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->71 73 Found malware configuration 2->73 75 Multi AV Scanner detection for submitted file 2->75 77 2 other signatures 2->77 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 signatures4 79 Writes to foreign memory regions 8->79 81 Allocates memory in foreign processes 8->81 15 regsvr32.exe 8->15         started        18 cmd.exe 1 8->18         started        20 rundll32.exe 8->20         started        24 2 other processes 8->24 22 rundll32.exe 11->22         started        process5 dnsIp6 93 Writes to foreign memory regions 15->93 95 Allocates memory in foreign processes 15->95 97 Queues an APC in another process (thread injection) 15->97 99 Delayed program exit found 15->99 27 wermgr.exe 15->27         started        101 Early bird code injection technique detected 18->101 31 rundll32.exe 18->31         started        33 wermgr.exe 3 20->33         started        36 wermgr.exe 22->36         started        45 171.103.187.218, 449, 49877, 49906 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH Thailand 24->45 47 88.87.15.96, 443, 49950, 49951 TELNET-ASBulgariaVelikoTarnovoBG Bulgaria 24->47 49 12 other IPs or domains 24->49 38 iexplore.exe 146 24->38         started        signatures7 process8 dnsIp9 57 179.42.137.108, 443, 49862, 49865 TelefonicadeArgentinaAR unknown 27->57 59 103.56.43.209, 449, 49929 EXPL-AS-INETHERNETXPRESSPVTLTDIN India 27->59 65 3 other IPs or domains 27->65 83 Tries to detect virtualization through RDTSC time measurements 27->83 85 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 27->85 87 Writes to foreign memory regions 31->87 89 Allocates memory in foreign processes 31->89 91 Delayed program exit found 31->91 40 wermgr.exe 31->40         started        61 179.42.137.104, 443, 49867, 49870 TelefonicadeArgentinaAR unknown 33->61 63 106.243.129.116, 443, 49939, 49973 LGDACOMLGDACOMCorporationKR Korea Republic of 33->63 67 8 other IPs or domains 33->67 43 C:\Users\user\AppData\...\dzcaDeExzp.trd, PE32 33->43 dropped 69 11 other IPs or domains 38->69 file10 signatures11 process12 dnsIp13 51 179.42.137.107, 443, 49807, 49811 TelefonicadeArgentinaAR unknown 40->51 53 194.190.18.122, 443, 49858, 49860 KTTRADE-ASRU Russian Federation 40->53 55 103.56.207.230, 443, 49912 ARGON-AS-IDArgonDataCommunicationID Indonesia 40->55
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441
TrickBot
367cd9c4f987db35c45539316388a22110adff7b0d0e51f63ceb4034a0037bfb
TrickBot
56c0dbbb56ab9b63c997eb80beb6392b50d507e4dc08ce617d32b8563fbd54ce
TrickBot
9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
TrickBot
f60d8bd3ca821e7de945f17d646654b7c0f25949aa8c6f780313925076444fc2
TrickBot
+ 3'410 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev4 banker trojan
Link:
https://tria.ge/reports/210913-158pfaeea8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
961f1781eea66f48c3c377c822824a69d2e49aa51dc536a77480ceef242e7c30
MD5 hash:
b0f610af180f5ba8800ab86d642a007c
SHA1 hash:
fad624004fd87a9b101eee309de8f18bc96a72d0
Link:
https://www.unpac.me/results/bee9090f-2217-487e-88ae-adafdc33eaeb/
SH256 hash:
21edebc9a450956047cb46217e7032b623b6b07d337eea24f92b3200c5bdada5
MD5 hash:
bbf41b475ba2243c1563e656fec89365
SHA1 hash:
b6484c74a8bd6934fb4c17bdea2b809fc142281f
Link:
https://www.unpac.me/results/bee9090f-2217-487e-88ae-adafdc33eaeb/
SH256 hash:
3e4fc3d8c5f8870717efaed16e99fd0d22a67ad962f9db98554359013cd9e955
MD5 hash:
894fc0425028a4f0df7af0adc66823c3
SHA1 hash:
7b3c9eea1466be95d5e3daeba870c7be2a83db70
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/bee9090f-2217-487e-88ae-adafdc33eaeb/
Parent samples :
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
0fae415c360c5be4b6b2a2e83c11b2b9d05afd5e3c98074328637e05164c96b3
1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805
07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020
096691e267868f40153264181ee8550a4537688fd4c98acb6af775c3c4ba0ebd
SH256 hash:
2d4ad904c75d895715b5c89fe28231f5bd25503e775670fc9b4187b8bef14d82
MD5 hash:
ced9f9ed8da5a64a0eff9bf55ed82811
SHA1 hash:
00891b83b35e722c8e4eed99fa9045727c8f64d2
Link:
https://www.unpac.me/results/bee9090f-2217-487e-88ae-adafdc33eaeb/
SH256 hash:
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
MD5 hash:
d342499ba2e3adab152c4c7ed9ead426
SHA1 hash:
0b4d212ac06d26e3fbb7365322d4cb7c5487444b
Link:
https://www.unpac.me/results/bee9090f-2217-487e-88ae-adafdc33eaeb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/074b3d896e53/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187591/

Comments