🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa
SHA3-384 hash: bd1395ff656f9ca4fe51be272569d10de9770aa00658410a78d6a9d7d995ec37fbf5bc90d422c88854ca4a8fe6ca4acb
SHA1 hash: a9be471157552ca374a615dd99c0452234981a4c
MD5 hash: 19960144c686dac775ed7bca893982b9
humanhash: cold-indigo-london-pasta
File name:roben.png
Download: download sample
Signature TrickBot
Create hunting rule
File size:1'813'504 bytes
First seen:2021-12-07 12:27:00 UTC
Last seen:2021-12-07 15:18:04 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 028cb2120eb61bdd8d53c72736111b16 (3 x TrickBot)
ssdeep 1536:JPwo+LV1pDpmE/X9XMp2nJ+bNCcMk0RzESN9dFMPiT1ak:9sTDpmK9RJ+8RzBfFMPiT1X
Threatray 5 similar samples on MalwareBazaar
TLSH T1AE8534041452E27CCA09FCBDC536B49250EF0AA48DA2EC0DED797F901EA16F9D56E6C3
Reporter proxylife
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
784
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/212119/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.9925.28085.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the Windows subdirectories
DNS request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/61af5319fa72c81b5b0ffdc2/reports/e5db986c-f961-406c-82f0-ce6a411e7654/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/323621db-72f0-497e-bddb-032f316b91de
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/903029
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 535514 Sample: roben.dll Startdate: 07/12/2021 Architecture: WINDOWS Score: 100 46 185.56.175.122 VIRTUAOPERATOR-ASPL Poland 2->46 48 24.162.214.166 TWC-11427-TEXASUS United States 2->48 50 14 other IPs or domains 2->50 60 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->60 62 Multi AV Scanner detection for domain / URL 2->62 64 Found malware configuration 2->64 66 5 other signatures 2->66 9 loaddll32.exe 1 2->9         started        11 rundll32.exe 2->11         started        signatures3 process4 process5 13 rundll32.exe 9->13         started        16 cmd.exe 1 9->16         started        18 rundll32.exe 9->18         started        20 rundll32.exe 11->20         started        signatures6 76 Writes to foreign memory regions 13->76 78 Allocates memory in foreign processes 13->78 22 wermgr.exe 3 13->22         started        27 cmd.exe 13->27         started        29 rundll32.exe 16->29         started        31 wermgr.exe 18->31         started        33 cmd.exe 18->33         started        35 wermgr.exe 20->35         started        37 cmd.exe 20->37         started        process7 dnsIp8 52 128.201.76.252, 443, 49748, 49750 PedroFArrudaJuniorMEBR Brazil 22->52 54 46.99.175.217, 443, 49738, 49740 IPKO-ASAL Albania 22->54 56 2 other IPs or domains 22->56 44 C:\Users\user\AppData\...\zbrobentr.wrf, PE32 22->44 dropped 68 Tries to harvest and steal browser information (history, passwords, etc) 22->68 70 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 22->70 72 Writes to foreign memory regions 29->72 74 Allocates memory in foreign processes 29->74 39 wermgr.exe 29->39         started        42 cmd.exe 29->42         started        file9 signatures10 process11 dnsIp12 58 216.166.148.187, 443, 49739, 49780 CYBERNET1US United States 39->58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-12-07 12:27:18 UTC
File Type:
PE (Sys)
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bz53g4rz7ethxdlzto7rtgxtyso4fmup2kvnzoxmxqhcwpfe5kva._file
Verdict:
malicious
Similar samples:
8bcfddc163b1eab5905425101e6af899c9ece1d64b9ad19ff58e6fa00f828ee5
TrickBot
922887fb6a1c30bfafa65a5f4541ed5b0cc0cea55af0f13ef67d13dea3cb785d
TrickBot
93e1576fbbdd4eb68ce942171651b0104372a0c0e0508af1913b0156d1c7fd86
TrickBot
b88341c4bb9c3f3c7bfebd5eaf68dadf2da424306f62b2ca82c3f02aa21b8e21
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob141 banker trojan
Link:
https://tria.ge/reports/211207-pmr37acaa6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
d3f37218e4838f80de085f37eaa09260661106b53f1ea51b6faa54173e862aa2
MD5 hash:
797103aaa1c87c7f34a6fd97cefe4770
SHA1 hash:
e0d1f07f2a6d71f6755a935386e6cfae385a0fe2
Link:
https://www.unpac.me/results/424a5991-f822-4d42-aae5-390094049b99/
SH256 hash:
a5ab69dd2ddd6ec2cabf87d7fa217aa3b38486ec8b0aed4c394c3c1c3c8ee3e7
MD5 hash:
3cb94843b9568ee7879714ec6f89346e
SHA1 hash:
265f747d50429e6285a5be91e15ceacdd0f1b107
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/424a5991-f822-4d42-aae5-390094049b99/
Parent samples :
93e1576fbbdd4eb68ce942171651b0104372a0c0e0508af1913b0156d1c7fd86
8bcfddc163b1eab5905425101e6af899c9ece1d64b9ad19ff58e6fa00f828ee5
b88341c4bb9c3f3c7bfebd5eaf68dadf2da424306f62b2ca82c3f02aa21b8e21
0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa
922887fb6a1c30bfafa65a5f4541ed5b0cc0cea55af0f13ef67d13dea3cb785d
48d6dd14a8dfe178a89ba9e2dd6de426581d51bf6009b53d125257827404eafc
11a97ea5de61a5c7302bb82c4fd6b149d5f2db5d8157e73773a447b477a9e075
8071e004a26eb2aaac4749720c6b34cebd0f60663fd4522324cdd658df6c456e
435e34ae36e41d9bc0bc9ae051ef42c21721a826daa55d243eec6c007b8bcb35
8c95d5b2eb5e1dbb54fe792f2937f30c16d097b608d4daf00333acae4f1877a7
ae44cfb5daa272b11b29f5f69272d36aec1c24777e47b8809f1f14cea6e8251a
e385fa8c3991479cb9622a746e36f1d42b86ae0a808c856db2c64bb70fdf332f
5be1b8ae825cdcf868fb9c74f5279eaaeb5f1e51a8b43b09db990445893fe493
d76a1f5e8c61d3f385bd3a12ca9328255840a46deebed0e9b68d5f9eeed76ebb
fff8e90fa87254267e45475007a3f1f11d8a0724c801bd63e50a80a0f06264ac
b7d072487f5ce621e5de0c6b4853a70c76b81e64ff282e29812f0e2301161ce5
81a165e0bad4e959de9fabf5035ff10470a5568afb4337c6bd38a0a7054a025e
82f54e902535c71d4ad8dae0da360528cf552bb183661774aa1f8af570888dd0
ecebd962cd96072dbe852befb2ee4fec6d25e330c63349dabdc4f279b21d7027
12086cdc5bcec06d1b8b549784a1b46fbe1a18a8330aff3fd4ed164e0ae1e9a9
8b7aeacc9c43fcc6535f43e1bb351d11074107e9f2cc9fdf29d3e3a6aed5d19d
8c7a8843e4335b2ac428b475a5765ae005a4ed2059db35002ce01c033728ead7
09487d34e30a980b92503f116d97ce80a8b20cfae702d03dca0e5e4eff79b4bd
100c03839669700c5fe5a8758ae8e059b3829ce4fa62067f916df0ee7d81747f
8c91542389027eed2415f9280f3537371001bd23570b1b198e60531141bf2623
46bd1136b087c10bb4bf2b301c1c6820d9c4cebd46adefc9a1bee1a09e8237b8
4936cf3cf44a80966e33629ea7656993dfb3e9fc371d1ce24be66d84fb5085d8
SH256 hash:
0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa
MD5 hash:
19960144c686dac775ed7bca893982b9
SHA1 hash:
a9be471157552ca374a615dd99c0452234981a4c
Link:
https://www.unpac.me/results/424a5991-f822-4d42-aae5-390094049b99/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/0e7bb37239f9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/0e7bb37239f9267b8d799bbf199af3c49dc2b28fd2aadcbaecbc0e2b3ca4eaaa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/212119/

Comments