🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
SHA3-384 hash: 3fb006880c097f9eb7119ace72b65d990e6b73392b5a6fbca10a5c3bc62ec9b5963ff9126f86583e10cd9b9bc5059130
SHA1 hash: 625bfb066ef13e19a59f6559cb3a1f42aba58d2b
MD5 hash: 3338255935766fef84a53e2aaaac6d34
humanhash: green-virginia-quiet-shade
File name:winSelBefore.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:3'099'782 bytes
First seen:2021-06-29 02:20:10 UTC
Last seen:2021-06-29 03:22:48 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e877652137f9a4cc34a0b63661b3ba6a (8 x TrickBot)
ssdeep 49152:bX85+GzBYx5ulXJyA889lRN2G6tEw1um7WHgKLES5fQC4NIINE67Qg3ErgbJwaT7:/ISulgA889lRN2G6mwggUrgbJyaBH
Threatray 3 similar samples on MalwareBazaar
TLSH C3E56D21E900903AF6EB00FBC3F7457DAD789B20131560D742C479EAEB66DD97932A27
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168653/
Detection(s):
SecuriteInfo.com.VHO.Trojan-Banker.Win32.Trickster.gen.15029.23277.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a4f4faeb-9067-46d5-a395-1a3aef37e637
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/809083
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441490 Sample: winSelBefore.jpg Startdate: 29/06/2021 Architecture: WINDOWS Score: 76 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Multi AV Scanner detection for submitted file 2->47 8 loaddll32.exe 1 2->8         started        process3 signatures4 51 Writes to foreign memory regions 8->51 53 Allocates memory in foreign processes 8->53 11 wermgr.exe 8->11         started        15 regsvr32.exe 8->15         started        17 iexplore.exe 1 74 8->17         started        19 2 other processes 8->19 process5 dnsIp6 39 103.164.180.66, 447, 49763 AARNET-AS-APAustralianAcademicandResearchNetworkAARNe unknown 11->39 41 49.248.217.170, 443, 49748, 49762 HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN India 11->41 43 8 other IPs or domains 11->43 55 Tries to detect virtualization through RDTSC time measurements 11->55 57 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 11->57 21 WerFault.exe 22 9 15->21         started        24 iexplore.exe 150 17->24         started        27 rundll32.exe 19->27         started        29 WerFault.exe 19->29         started        signatures7 process8 dnsIp9 49 Tries to evade analysis by execution special instruction which cause usermode exception 21->49 33 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49744, 49745 FASTLYUS United States 24->33 35 geolocation.onetrust.com 104.20.184.68, 443, 49727, 49728 CLOUDFLARENETUS United States 24->35 37 10 other IPs or domains 24->37 31 WerFault.exe 17 9 27->31         started        signatures10 process11
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-06-29 01:05:41 UTC
AV detection:
8 of 46 (17.39%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bo3zplxzoeounjkpgy5q2kbbcm3waxnx3bfqphurzlthf55jqhka._file
Verdict:
unknown
Similar samples:
32a8d650cdb03abcc979011c25a18411afc65a7e8012e8c1a6cb4125ba6d83aa
TrickBot
afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc
TrickBot
d9246658c652dfdbd5072768db4183dd4a032184b0c3c9adc014687ad60b13d2
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev1 banker trojan
Link:
https://tria.ge/reports/210629-pwaz9kaesn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
d74438ba6ce59d50531b9e5396b9ac911dfd1a5c02d84698940836c16d30f615
MD5 hash:
0d9285e6e7e1adf77a48b8c72b21cf27
SHA1 hash:
ef26edf4573c161e2e0d84136f2a03790acbbef0
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7622cef6-1fdd-4436-aceb-5ac879de1be4/
Parent samples :
8368a955dd5d9850ed8ced6144a202368c52e065abafdb71a7960d3a90647e85
9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba
b827fde51c75a1c5a400dd99d5b345f946874d77587384d31e3ca188364e92a4
c601014207780cd2448d3953272a43cacc9252bc86b365b7869af2a6a2ab3c09
b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28
97c1deed13a9dba0c5834c3961ec93f96897e45e56f1c86a641427228830fcd4
0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
SH256 hash:
84a2daa18ecfa084df7889d6f25aa5b775c46c14203fe94962f2479031019c08
MD5 hash:
b77e64162a21fd6ba5c027923a0acbdc
SHA1 hash:
11da5592527274d1353c1d6361a4f3b04e771af9
Link:
https://www.unpac.me/results/7622cef6-1fdd-4436-aceb-5ac879de1be4/
SH256 hash:
0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
MD5 hash:
3338255935766fef84a53e2aaaac6d34
SHA1 hash:
625bfb066ef13e19a59f6559cb3a1f42aba58d2b
Link:
https://www.unpac.me/results/7622cef6-1fdd-4436-aceb-5ac879de1be4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/168653/

Comments