🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020
SHA3-384 hash: 657909c5cc91b934eab4c06f9ecc2ec5cc56a6f8523074224fc9dccf4420702e8efb564c3a83ea528e0cefc22b562f4d
SHA1 hash: f704051ab697e563e1141cf9c8b735b882d01ecd
MD5 hash: 17c7756e5799a81c5a0a33658d4e3fc0
humanhash: beer-stairway-hawaii-foxtrot
File name:prevPwDe.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:577'666 bytes
First seen:2021-09-13 22:16:20 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2447835d91955d5899b703294ffbcca5 (5 x TrickBot)
ssdeep 12288:5YzxeJ5ui1dZLGCD8atyw1L5+xWQaO76En:5weTuqrLGK0I9AasB
Threatray 3'436 similar samples on MalwareBazaar
TLSH T13DC4CF0236E1C47AC5EE273459A35B1932F9FC114A76C287A745FA4E5E333C29C3A35A
dhash icon 0000000000000000 (907 x AgentTesla, 573 x Formbook, 316 x RedLineStealer)
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot


Avatar
malware_traffic
Run method: regsvr32.exe [filename]

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/187595/
Detection(s):
SecuriteInfo.com.ML.PE-A.9195.23024.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/617506a4db358dd15ed91e8c/reports/cfd88bfb-fdbb-4b4a-a873-f78e4aef68d1/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5b8e4550-c87f-4ddc-a38d-08e57ecd1a21
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/850216
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 482643 Sample: prevPwDe.jpg Startdate: 14/09/2021 Architecture: WINDOWS Score: 100 51 Found malware configuration 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 Yara detected Trickbot 2->55 57 Sigma detected: Regsvr32 Command Line Without DLL 2->57 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        process3 signatures4 69 Writes to foreign memory regions 8->69 71 Allocates memory in foreign processes 8->71 13 regsvr32.exe 8->13         started        16 cmd.exe 1 8->16         started        18 rundll32.exe 8->18         started        20 2 other processes 8->20 process5 signatures6 73 Writes to foreign memory regions 13->73 75 Allocates memory in foreign processes 13->75 77 Queues an APC in another process (thread injection) 13->77 22 wermgr.exe 13->22         started        79 Early bird code injection technique detected 16->79 26 rundll32.exe 16->26         started        28 wermgr.exe 18->28         started        30 iexplore.exe 146 20->30         started        process7 dnsIp8 37 191.36.152.198, 443, 49843, 49845 VIPTURBOCOMERCIOSERVICOSDEINFORMATICALTDABR Brazil 22->37 39 179.42.137.107, 443, 49813, 49815 TelefonicadeArgentinaAR unknown 22->39 41 18.139.111.104, 443, 49864 AMAZON-02US United States 22->41 59 Tries to detect virtualization through RDTSC time measurements 22->59 61 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 22->61 63 Writes to foreign memory regions 26->63 65 Allocates memory in foreign processes 26->65 67 Delayed program exit found 26->67 32 wermgr.exe 26->32         started        43 103.56.43.209, 449, 49844, 49865 EXPL-AS-INETHERNETXPRESSPVTLTDIN India 28->43 45 45.239.232.200, 443, 49866 SPEEDNETFRUTALNETFIBRAEWIRELESSBR Brazil 28->45 47 7 other IPs or domains 28->47 49 9 other IPs or domains 30->49 signatures9 process10 dnsIp11 35 103.56.207.230, 443, 49814 ARGON-AS-IDArgonDataCommunicationID Indonesia 32->35
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
TrickBot
096691e267868f40153264181ee8550a4537688fd4c98acb6af775c3c4ba0ebd
TrickBot
0fae415c360c5be4b6b2a2e83c11b2b9d05afd5e3c98074328637e05164c96b3
TrickBot
367cd9c4f987db35c45539316388a22110adff7b0d0e51f63ceb4034a0037bfb
TrickBot
56c0dbbb56ab9b63c997eb80beb6392b50d507e4dc08ce617d32b8563fbd54ce
TrickBot
9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
TrickBot
f60d8bd3ca821e7de945f17d646654b7c0f25949aa8c6f780313925076444fc2
TrickBot
+ 3'426 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev4 banker trojan
Link:
https://tria.ge/reports/210913-17cpsaheej/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
179.42.137.102:443
191.36.152.198:443
179.42.137.104:443
179.42.137.106:443
179.42.137.108:443
202.183.12.124:443
194.190.18.122:443
103.56.207.230:443
171.103.187.218:449
171.103.189.118:449
18.139.111.104:443
179.42.137.105:443
186.4.193.75:443
171.101.229.2:449
179.42.137.107:443
103.56.43.209:449
179.42.137.110:443
45.181.207.156:443
197.44.54.162:449
179.42.137.109:443
103.59.105.226:449
45.181.207.101:443
117.196.236.205:443
72.224.45.102:449
179.42.137.111:443
96.47.239.181:443
171.100.112.190:449
117.196.239.6:443
Unpacked files
SH256 hash:
961f1781eea66f48c3c377c822824a69d2e49aa51dc536a77480ceef242e7c30
MD5 hash:
b0f610af180f5ba8800ab86d642a007c
SHA1 hash:
fad624004fd87a9b101eee309de8f18bc96a72d0
Link:
https://www.unpac.me/results/c008f30f-e031-4e94-ba3d-b38ca2a79b66/
SH256 hash:
21edebc9a450956047cb46217e7032b623b6b07d337eea24f92b3200c5bdada5
MD5 hash:
bbf41b475ba2243c1563e656fec89365
SHA1 hash:
b6484c74a8bd6934fb4c17bdea2b809fc142281f
Link:
https://www.unpac.me/results/c008f30f-e031-4e94-ba3d-b38ca2a79b66/
SH256 hash:
3e4fc3d8c5f8870717efaed16e99fd0d22a67ad962f9db98554359013cd9e955
MD5 hash:
894fc0425028a4f0df7af0adc66823c3
SHA1 hash:
7b3c9eea1466be95d5e3daeba870c7be2a83db70
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/c008f30f-e031-4e94-ba3d-b38ca2a79b66/
Parent samples :
074b3d896e53fc8335cdea4b0f565e01b99ee9041c01d9c17a23f67409b138c1
0fae415c360c5be4b6b2a2e83c11b2b9d05afd5e3c98074328637e05164c96b3
1c3eeb573dc5bc74ca1ce3cb1e9a2d7b26102ae6dbde1df38f0536e28eb9c805
07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020
096691e267868f40153264181ee8550a4537688fd4c98acb6af775c3c4ba0ebd
SH256 hash:
2d4ad904c75d895715b5c89fe28231f5bd25503e775670fc9b4187b8bef14d82
MD5 hash:
ced9f9ed8da5a64a0eff9bf55ed82811
SHA1 hash:
00891b83b35e722c8e4eed99fa9045727c8f64d2
Link:
https://www.unpac.me/results/c008f30f-e031-4e94-ba3d-b38ca2a79b66/
SH256 hash:
07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020
MD5 hash:
17c7756e5799a81c5a0a33658d4e3fc0
SHA1 hash:
f704051ab697e563e1141cf9c8b735b882d01ecd
Link:
https://www.unpac.me/results/c008f30f-e031-4e94-ba3d-b38ca2a79b66/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/07d1bd48ef3b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/07d1bd48ef3b4baf2e8498b3a2dc406c533c90bce7a2cb963506b6889330c020

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/187595/

Comments