MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32515d546db78a132c9c6b711f816797fcb110f491aaddcb9ac86a38849c3837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 32515d546db78a132c9c6b711f816797fcb110f491aaddcb9ac86a38849c3837
SHA3-384 hash: b8882a109557793448422558780b0b4d682829b0dea643cb4732a4cd483bb9e5ed1af156c5741b35d09fbb12393de25b
SHA1 hash: 3225e0746204cb075a119338ddcae2f80c01b671
MD5 hash: 85b49e2f6ba45dca7baf838ecfea1cfc
humanhash: cold-shade-mars-blossom
File name:asesx.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:355'840 bytes
First seen:2021-01-28 17:38:43 UTC
Last seen:2021-01-28 20:57:58 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 561d98ae5c680d7585ecb2e6551a975f (1 x TrickBot)
ssdeep 6144:rbNx7+FAMa3tK18pJYTVHhupMe20O8w9/taYpgd8OGOOhNXSWcj:PNx8KPAVBufY8MaY6d89Oqb
Threatray 165 similar samples on MalwareBazaar
TLSH 2B74F20876FA8B91D3E56EF6C98CC8A54C287CFA1C31F513749B6E5ABCFD115442520E
Reporter JAMESWT_WT
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/114275/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APW.3722.14037.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/593201
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/32515d546db78a132c9c6b711f816797fcb110f491aaddcb9ac86a38849c3837/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-28 17:37:44 UTC
File Type:
PE (Dll)
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0f6e1a84d618af64ce5864d7b7a0d946439b3f82efa34f994cb420dc3d11fb71
TrickBot
2daee8093a5e8dcd35e17c353a86b6969d09e5d75509f0184d5477cf87260f92
TrickBot
40e665c7875b98b0f5f5225666c6502616aa64f22c8e6d6d012c606b092e0b53
TrickBot
667f88e8dcd4a15529ed02bb20da6ae2e5b195717eb630b20b9732c8573c4e83
TrickBot
6ad7afd41c395e87314488f1aeb47244de899abb289feba16c9ffbde7f55f15e
TrickBot
74976d37d3e53fc66a54b5b8010969340da5099c200e75e7c5b20f41e06a4a57
TrickBot
7f12ab6909f7a932ee097634ab529b1e2c1f07534097785c90ff03eb9671e784
TrickBot
8b49bc1afd15dcc2bcc23b7637d58aca9a17b5b8a9e66ebdd109200fda384f0e
TrickBot
8d44fdbedd0ec9ae59fad78bdb12d15d6903470eb1046b45c227193b233adda6
TrickBot
f893e2e5b6cb171f4cbe389fa1ce8565a12c01da43c997d8439af8f4a41af668
TrickBot
+ 155 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob42 banker trojan
Link:
https://tria.ge/reports/210128-abm92faan2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
5.34.180.180:443
64.74.160.228:443
198.46.198.116:443
5.34.180.185:443
107.152.46.188:443
195.123.241.214:443
23.254.224.2:443
107.172.188.113:443
200.52.147.93:443
185.198.59.45:443
45.14.226.101:443
185.82.126.38:443
85.204.116.139:443
45.155.173.248:443
103.91.244.50:443
45.230.244.20:443
45.226.124.226:443
187.84.95.6:443
186.250.157.116:443
186.137.85.76:443
36.94.62.207:443
182.253.107.34:443
180.92.158.244:443
Unpacked files
SH256 hash:
c8aaf3aa3cd4d331648c385c175fcebea406e08214d892c832629a5048d5a7e1
MD5 hash:
064d643050b209d07e94347fc99e979f
SHA1 hash:
a7ecadf91aa9efdd2e94141692c82e0ceb3d1f62
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/775e5056-e8ca-43f0-b082-31e5bd462931/
SH256 hash:
97477395c902455061900ac8793e1d094b8f736f505d0266a21ae7b03fdd5e3b
MD5 hash:
b321028368f983d7ebe75bd4574e8854
SHA1 hash:
585e731423c1d5bc8e78b947edd29e6efc7b7845
Link:
https://www.unpac.me/results/775e5056-e8ca-43f0-b082-31e5bd462931/
SH256 hash:
32515d546db78a132c9c6b711f816797fcb110f491aaddcb9ac86a38849c3837
MD5 hash:
85b49e2f6ba45dca7baf838ecfea1cfc
SHA1 hash:
3225e0746204cb075a119338ddcae2f80c01b671
Link:
https://www.unpac.me/results/775e5056-e8ca-43f0-b082-31e5bd462931/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/32515d546db78a132c9c6b711f816797fcb110f491aaddcb9ac86a38849c3837

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 32515d546db78a132c9c6b711f816797fcb110f491aaddcb9ac86a38849c3837

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/981976/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/114275/

Comments