🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270
SHA3-384 hash: 6edb8fe1bd5d61945d2433105703453e8224486d4ec97776018447f085ae7389dfc0cc2203d051aff2f613a62becbe48
SHA1 hash: cbaf22dd9c71656473f927ffd37f1d415acb9a99
MD5 hash: c7c63b06245e6845c07bf4d2a9638bd9
humanhash: kitten-double-avocado-artist
File name:c7c63b06245e6845c07bf4d2a9638bd9
Download: download sample
Signature TrickBot
Create hunting rule
File size:442'368 bytes
First seen:2021-10-19 06:28:31 UTC
Last seen:2021-10-19 07:59:26 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 5fa5234c56c604654f201a027c1f2ff7 (2 x TrickBot)
ssdeep 6144:/wvR6AqCgTAX3m05C0LG7HlBRQ3kLcSm43/LOQU4GIXxdpCCWkNU1:/wvRp+Twz5CEGjHRQ3In4B
Threatray 53 similar samples on MalwareBazaar
TLSH T14B948D7DC0590174EA8E5EFCDD286BDDB66E6ED36A64E00D861E28C349723FEC061523
Reporter zbetcheckin
Tags:32 dll exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
304
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/198394/
Detection(s):
SecuriteInfo.com.ML.PE-A.6811.24827.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/616e65b4db358dd15ec2d045/reports/a0a3313c-787b-4ccb-9cae-4af9b52cf798/overview
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/95e43a68-1e42-4125-bc48-b73647cfa44e
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/872864
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 505289 Sample: 3r3hOVB7Hj Startdate: 19/10/2021 Architecture: WINDOWS Score: 88 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Trickbot 2->50 8 loaddll32.exe 1 2->8         started        10 rundll32.exe 2->10         started        process3 process4 12 rundll32.exe 8->12         started        15 cmd.exe 1 8->15         started        17 rundll32.exe 8->17         started        signatures5 60 Writes to foreign memory regions 12->60 62 Allocates memory in foreign processes 12->62 19 wermgr.exe 12->19         started        23 cmd.exe 12->23         started        25 rundll32.exe 15->25         started        27 wermgr.exe 17->27         started        29 cmd.exe 17->29         started        process6 dnsIp7 36 185.56.175.122, 443, 49747, 49839 VIRTUAOPERATOR-ASPL Poland 19->36 52 Tries to detect virtualization through RDTSC time measurements 19->52 54 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 19->54 56 Writes to foreign memory regions 25->56 58 Allocates memory in foreign processes 25->58 31 wermgr.exe 25->31         started        34 cmd.exe 25->34         started        signatures8 process9 dnsIp10 38 105.27.205.34, 443, 49758, 49840 SEACOM-ASMU Mauritius 31->38 40 46.99.175.217, 443, 49748, 49752 IPKO-ASAL Albania 31->40 42 4 other IPs or domains 31->42
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270/
Verdict:
malicious
Similar samples:
25db81a9c27d2c56fb1d168f3416260ae33470a32e8adb3ff15a0b30e43abc6d
TrickBot
34fc69d9d5119015a1f946f18069d1464c45e02b5716b91ae2c99eb493ef7242
TrickBot
39326cdd0c863e1766ecc3d119ec18fdaa93ef886cfbc887f76784f745df73e4
TrickBot
40503a4df817599fdf0125c5b99076700718e3eb50bbb759d139aa95a8d18d59
TrickBot
4d9a3ce8ea01677b182e55858ff0373a94ae4dcd30e777aa9e5e71d61e40db37
TrickBot
5c7b6c75eee95614a740b733b6895346066ae6c893c7b7cc8885ffa425ca6c86
TrickBot
7dff88b3b51db9f32b155133aba7bff719133a881082bbffd5dad02f7acf79e6
TrickBot
9f8f76b6e791499bedf04630e7942a2e2d4792969d3c219b598f7a20596f767a
TrickBot
a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
TrickBot
e8ced66e2e2f78e7b4360155e2513cb99aa57d9743b1eab6430cffaa7d8c3523
TrickBot
+ 43 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:soc1 banker trojan
Link:
https://tria.ge/reports/211019-g8xxkafcg8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
85788ccbd2729da4e8447f95fa54b7ad3f5aa3b38bdab56a803e88a6cb4a626a
MD5 hash:
273786a03a4d27105d0579f169e6ca5c
SHA1 hash:
b07a7f8107d33f7675a5a6a00114e17cfe8dc750
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0c9cb908-d76a-459e-8a14-ca1e78ab06cb/
Parent samples :
173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270
ae8c7f2523df408080977a47e685b01465aea023f7eb24f382c88cc804590aac
SH256 hash:
726882ad5cda846922266606ad163c9af38f93c08bb9b8c1af4243c873c37a86
MD5 hash:
5524db85f2fd9d75afc1cbe987d6dc9f
SHA1 hash:
39bddcae71ff40132c9e22ef3dd7c92bdbbfbdf2
Link:
https://www.unpac.me/results/0c9cb908-d76a-459e-8a14-ca1e78ab06cb/
SH256 hash:
173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270
MD5 hash:
c7c63b06245e6845c07bf4d2a9638bd9
SHA1 hash:
cbaf22dd9c71656473f927ffd37f1d415acb9a99
Link:
https://www.unpac.me/results/0c9cb908-d76a-459e-8a14-ca1e78ab06cb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/173cf0607132/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 173cf0607132f17aec3d417d3a4a13bbf8eebabe88578240a42c5fb855f2b270

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/198394/

Comments


Avatar
zbet commented on 2021-10-19 06:28:32 UTC

url : hxxp://45.148.120.35/images/subzero.png