MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb
SHA3-384 hash: 37e8c8ab33b2192e3d9023506d2dd5d4b7f65705e8bfda17664692cc1d029b3228137fb384a81989a2f1e94b2e432c9f
SHA1 hash: 13ce16ede2f14b74c0ea4a311e9039e99ad44a52
MD5 hash: 4b7ed1742ec9188ecbc5674fc18bfa4f
humanhash: yankee-neptune-alabama-oklahoma
File name:4b7ed1742ec9188ecbc5674fc18bfa4f.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:560'128 bytes
First seen:2021-03-02 07:58:39 UTC
Last seen:2021-03-02 09:54:29 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 70bc05ed61950942c110ac0ac682d41e (1 x TrickBot)
ssdeep 12288:ddZBfHc3stWdyAHt6cE6PJZ897Chsd6Tg6ByTK0izJ:JNNsTYcESqOCegkyTr
Threatray 4 similar samples on MalwareBazaar
TLSH D7C4C031F5484422C4FE1E376870BFC7D52DE39CAF1256A7726C0A4C9B648E187A6B17
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
4
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/120848/
Detection(s):
SecuriteInfo.com.Variant.Razy.848795.3150.25476.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/623432
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 360706 Sample: 6Sd99kYOfj.dll Startdate: 02/03/2021 Architecture: WINDOWS Score: 68 29 ipinfo.io 2->29 43 Multi AV Scanner detection for submitted file 2->43 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 cmd.exe 1 9->14         started        16 regsvr32.exe 9->16         started        signatures6 45 Writes to foreign memory regions 11->45 47 Allocates memory in foreign processes 11->47 49 Delayed program exit found 11->49 18 wermgr.exe 11->18         started        21 wermgr.exe 11->21         started        23 iexplore.exe 1 75 14->23         started        process7 dnsIp8 39 Tries to detect virtualization through RDTSC time measurements 18->39 41 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 18->41 31 192.168.2.1 unknown unknown 23->31 26 iexplore.exe 154 23->26         started        signatures9 process10 dnsIp11 33 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49730, 49731 FASTLYUS United States 26->33 35 geolocation.onetrust.com 104.20.185.68, 443, 49718, 49719 CLOUDFLARENETUS United States 26->35 37 8 other IPs or domains 26->37
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb/
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2021-03-02 07:52:16 UTC
File Type:
PE (Dll)
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bp3bbol6yikqd4muq3f4dz325qtm5iw2nx5asdzpn6hdf2iudg5q._file
Verdict:
unknown
Similar samples:
3581d9d26a6241ca4b678491855f776f994dbdb626b8cc940ed3ea2346a27626
TrickBot
8a62494f7bea6510be4df0e3930a843be84b6dd88f966f99a93a7a1b691cb467
TrickBot
d554277d372d592a363f7d7f1bfb1bf658c8ab3462d6ae255a6423b78b57f404
TrickBot
df2cd85e680109ae7e50534b301372709c16ee01ff58bce643c15e45b420953f
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon95 banker trojan
Link:
https://tria.ge/reports/210302-bqcemfzrsa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
e38d7d696bfda263ca52c0fe23555b1ffb71655cc257840a5bf9b46b709bec23
MD5 hash:
b15b9286779b3e698b43ef2d75136672
SHA1 hash:
4ee63e3f46f2993e72fa984ed3cbaf845d5d558a
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dcd10f1e-9393-4fa0-8e5b-9e6196e0f67d/
SH256 hash:
8130bdac2a84c14eb98b1aab72dca4cb5a876158ca2241ece9f20effb627c4d4
MD5 hash:
8897fce4c1977c05660e9f5e953ed085
SHA1 hash:
da328a646f90e47a2e7f3d8d0c5f7afce4c318ef
Link:
https://www.unpac.me/results/dcd10f1e-9393-4fa0-8e5b-9e6196e0f67d/
SH256 hash:
0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb
MD5 hash:
4b7ed1742ec9188ecbc5674fc18bfa4f
SHA1 hash:
13ce16ede2f14b74c0ea4a311e9039e99ad44a52
Link:
https://www.unpac.me/results/dcd10f1e-9393-4fa0-8e5b-9e6196e0f67d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/120848/
  
URLhaus
https://urlhaus.abuse.ch/url/1041767/
  
Delivery method
Distributed via web download

Comments