MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2912dc387b23031fe0bae16d60c066d1837781b14eacaad14a28bbf69f7f0196. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2912dc387b23031fe0bae16d60c066d1837781b14eacaad14a28bbf69f7f0196
SHA3-384 hash: 186a71e7475a408284228391b09a0a75d15a0a3247fd796e684422de5b79018f7757c0ade17fd9af008ac4c850553e8c
SHA1 hash: edeb88eefd2190f018b0c54930bfca694a95e689
MD5 hash: de63e7e3da96f915446dff531a4c09dc
humanhash: nine-september-high-hamper
File name:SecuriteInfo.com.generic.ml.2590.29377
Download: download sample
Signature TrickBot
Create hunting rule
File size:561'152 bytes
First seen:2021-04-09 19:57:06 UTC
Last seen:2021-04-09 20:49:12 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 6d6bd235df3ee5ac1f73ff8deff89fd6 (1 x TrickBot)
ssdeep 12288:WlPw8rbIHS9Ig8fbHiBzGS/lXkit+bB2LW:Mw8rEHS9Ig6C1HNjOB2L
Threatray 1'077 similar samples on MalwareBazaar
TLSH 14C4CF1272D1C076C8EF06751556D79952FEBC10AEF5C287FF913B0E6E326828A3835A
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
388
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/133440/
Detection(s):
SecuriteInfo.com.generic.ml.2590.29377.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/671753
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses Windows timers to delay execution
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384821 Sample: SecuriteInfo.com.generic.ml... Startdate: 09/04/2021 Architecture: WINDOWS Score: 88 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected Trickbot 2->45 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 20 8->10         started        13 rundll32.exe 8 8->13         started        15 cmd.exe 1 8->15         started        signatures5 47 Writes to foreign memory regions 10->47 49 Allocates memory in foreign processes 10->49 51 Uses Windows timers to delay execution 10->51 17 wermgr.exe 10->17         started        20 wermgr.exe 13->20         started        23 rundll32.exe 8 15->23         started        process6 dnsIp7 29 Found potential dummy code loops (likely to delay analysis) 17->29 31 Tries to detect virtualization through RDTSC time measurements 17->31 33 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->33 27 192.168.2.1 unknown unknown 20->27 35 Writes to foreign memory regions 23->35 37 Allocates memory in foreign processes 23->37 39 Uses Windows timers to delay execution 23->39 25 wermgr.exe 23->25         started        signatures8 process9
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/2912dc387b23031fe0bae16d60c066d1837781b14eacaad14a28bbf69f7f0196/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-04-09 17:22:50 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fejnyod3embr7yf24fwwbqdg2gbxpanrj2wkvukkfc57nh37agla._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1e472b9de49871cbf3a381b560312a55163a196213329fdae34f4bbae6dd9d20
TrickBot
31f32aa38a987ca660553f3ed615c44f096e23ff80192a7922f273b1e474858b
TrickBot
389ec465ec5038ddb8eaa907961d5602fb23bab039b4f262151526331e15b4bc
TrickBot
72bc9f1cd24703393c011afc90cd4c7e689476c7ab43ac0f9787283e3fd6eb81
TrickBot
8701bac8488c56fb1ee4177cd41bbc54dda261e31edf98e7058957621dd5f291
TrickBot
8fbf1590771243d6acff1df44382a63b7cd5ef14c0c3d0e0b52129b415058115
TrickBot
9050396227d5aa1fab746a29861ad3c25be2bcf4a7edaa97d67b6f4e24666b3f
TrickBot
a3cebf31e185cfae066634a108c3bee7de5c32475411c5398525e2e2caf00d80
TrickBot
d70803dc31e45825416b5391969ab9042baa17c01e080382a4340cef54090c84
TrickBot
fd3af0e7890546cc6e6ee828df5a31a4c88c587f968b0298a672b703bf71b7e4
TrickBot
+ 1'067 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob50 banker trojan
Link:
https://tria.ge/reports/210409-b7xtlkwvra/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
89.250.208.42:449
182.253.184.130:449
31.211.85.110:443
85.112.74.178:449
102.68.17.97:443
103.76.150.14:443
96.9.77.142:443
91.185.236.170:449
87.76.1.81:449
91.225.231.120:443
62.213.14.166:443
81.95.45.234:449
148.216.32.55:443
109.185.139.90:449
202.166.211.197:443
196.41.57.46:449
84.21.206.164:449
190.122.168.219:443
77.95.93.132:449
41.77.134.250:443
87.116.151.237:449
185.205.250.162:443
103.9.188.23:449
78.138.187.231:443
138.185.72.142:443
173.81.4.147:443
31.134.124.90:443
200.90.11.177:449
5.59.205.32:443
Unpacked files
SH256 hash:
25e15fbe1f1a27e399be338e234fa284a4d4f9b0a5ad200f295b932fe1fb7c7c
MD5 hash:
0f400ec8d212f83c18ba84ed08239f85
SHA1 hash:
71f10dfa966467c93ce13412efb02cccdd9f2c2e
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/bf0c5d22-e26a-4eac-be24-ce89d46e74df/
SH256 hash:
0acb4aab9133e3b7830209137ed553b158aa7b2e7376887f1cf58ec3b2f5926a
MD5 hash:
a21537040f6b4ed77825fe0d66d486b5
SHA1 hash:
db80c71d254b5ad593137425a0842be69f2c92d3
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/bf0c5d22-e26a-4eac-be24-ce89d46e74df/
SH256 hash:
769274793184c7ce6c2508d5a974b7629c75880e0b7f46238798feafbabd5434
MD5 hash:
8aec67a922d49c0763768d296a83e5f2
SHA1 hash:
ea9fa96abe2ac5be7280586a6fcff1319c73499b
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/bf0c5d22-e26a-4eac-be24-ce89d46e74df/
SH256 hash:
2912dc387b23031fe0bae16d60c066d1837781b14eacaad14a28bbf69f7f0196
MD5 hash:
de63e7e3da96f915446dff531a4c09dc
SHA1 hash:
edeb88eefd2190f018b0c54930bfca694a95e689
Link:
https://www.unpac.me/results/bf0c5d22-e26a-4eac-be24-ce89d46e74df/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2912dc387b23031fe0bae16d60c066d1837781b14eacaad14a28bbf69f7f0196

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 2912dc387b23031fe0bae16d60c066d1837781b14eacaad14a28bbf69f7f0196

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1105161/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1105162/
Cape
Cape
https://www.capesandbox.com/analysis/133440/

Comments