MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441
SHA3-384 hash: 4cb0f643a1faae2693c30e19885a15109635b782ce9a1cb7c0b24b8c346931187fe1c4d1a020682e637166590e836111
SHA1 hash: e59718e913ec2f993a4c08e8098e9af8f00663c2
MD5 hash: d6c057e338fd2884d4ae0ff6a5026eb7
humanhash: seven-moon-william-leopard
File name:plotterline.png
Download: download sample
Signature TrickBot
Create hunting rule
File size:716'851 bytes
First seen:2021-08-17 13:43:38 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 0293ee5688b0a5f1cbe136d065e99917 (3 x TrickBot)
ssdeep 12288:zbxfY510CzWwF0quExYmSN+oMdFZEMgIeZxs7WNJaX6FAx:96WwWquEiJdMdUIFbX0Ax
Threatray 1'519 similar samples on MalwareBazaar
TLSH T16CE4D011FAD1C077C2AE06302F527BB967F9ECA16EB5D507E744F78F0E32941462A222
dhash icon ceaaba8e92a870b0 (3 x TrickBot)
Reporter abuse_ch
Tags:dll rob123 TrickBot


Avatar
abuse_ch
TrickBot payload URLs:
http://185.244.41.34/premier.php
http://89.41.182.90/images/plotterline.png

TrickBot C2s:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179983/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5b5c0cd3-acfc-4db4-9421-a399fcee56d6
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/834382
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
May check the online IP address of the machine
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 466809 Sample: plotterline.png Startdate: 17/08/2021 Architecture: WINDOWS Score: 100 78 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->78 80 Found malware configuration 2->80 82 Yara detected Trickbot 2->82 84 2 other signatures 2->84 9 loaddll32.exe 1 2->9         started        11 rundll32.exe 2->11         started        13 rundll32.exe 2->13         started        process3 process4 15 rundll32.exe 9->15         started        18 cmd.exe 1 9->18         started        20 rundll32.exe 9->20         started        22 rundll32.exe 11->22         started        signatures5 100 Writes to foreign memory regions 15->100 102 Allocates memory in foreign processes 15->102 104 Delayed program exit found 15->104 24 wermgr.exe 3 15->24         started        29 cmd.exe 15->29         started        31 rundll32.exe 18->31         started        33 wermgr.exe 20->33         started        35 cmd.exe 20->35         started        37 wermgr.exe 22->37         started        39 cmd.exe 22->39         started        process6 dnsIp7 72 185.56.175.122, 443, 49708, 49713 VIRTUAOPERATOR-ASPL Poland 24->72 74 182.253.210.130, 443, 49714 BIZNET-AS-APBIZNETNETWORKSID Indonesia 24->74 76 6 other IPs or domains 24->76 56 C:\Users\user\AppData\...\pnplotterlinezh.dmo, PE32 24->56 dropped 86 Hijacks the control flow in another process 24->86 88 May check the online IP address of the machine 24->88 90 Writes to foreign memory regions 24->90 94 2 other signatures 24->94 41 svchost.exe 5 24->41         started        45 svchost.exe 24->45         started        47 svchost.exe 24->47         started        92 Allocates memory in foreign processes 31->92 49 wermgr.exe 31->49         started        52 cmd.exe 31->52         started        file8 signatures9 process10 dnsIp11 58 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 41->58 dropped 60 C:\Users\user\AppData\...\Login Data.bak, SQLite 41->60 dropped 62 C:\Users\user\AppData\Local\...\History.bak, SQLite 41->62 dropped 64 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 41->64 dropped 96 Tries to harvest and steal browser information (history, passwords, etc) 41->96 66 75.176.235.182, 443, 49723 TWC-11426-CAROLINASUS United States 49->66 68 60.51.47.65, 443, 49709, 49720 TMNET-AS-APTMNetInternetServiceProviderMY Malaysia 49->68 70 6 other IPs or domains 49->70 98 Writes to foreign memory regions 49->98 54 svchost.exe 49->54         started        file12 signatures13 process14
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0add7ef3e57fd9a619be1befd6df759a53b53952c4c2b4a10facdddedcc5174c
TrickBot
2181358d62d130161a6a06e4b3a9081a2da06a363f6918a5b1345c36775bb315
TrickBot
367cd9c4f987db35c45539316388a22110adff7b0d0e51f63ceb4034a0037bfb
TrickBot
58eb3b6a9dd371f2b5c39166f7f52d0fdaa6ec8a32962221cf4f44a47c3e67e7
TrickBot
6c238a124150dc1298bd6a347e8628b51ca2d5ae04b0181270a5928aedc63ad9
TrickBot
9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
TrickBot
bf81ad343dce8b514941ffd47576b78e02b41c23aec991fd5a48ad00c67ad942
TrickBot
ff460f5b7a62a1fcd51e82bf43fc7b5264552c53e3924ffb771d7c8355a99ade
TrickBot
+ 1'509 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob123 banker trojan
Link:
https://tria.ge/reports/210817-658rrz3b5e/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
e1240e75e0fc17ea2156e5b5358472fa7eae2ed433b867fa5f179443994ac22b
MD5 hash:
807555146a204eff372b80030b5e1c96
SHA1 hash:
aa4bc5c8d27289ba48e1faa855cac38a010d42d0
Link:
https://www.unpac.me/results/37678ca4-f130-4b8d-9329-54c9e56e3f7f/
SH256 hash:
8df5cf5286f9a1764cfbb68eb1736bfa23ff1068fdc3fedf6d23f5c276073c76
MD5 hash:
4738d83379e8005526da6f954d416e47
SHA1 hash:
8d18c4405fa145378222ebcde0e79e1ab3c31d32
Link:
https://www.unpac.me/results/37678ca4-f130-4b8d-9329-54c9e56e3f7f/
SH256 hash:
ac34d2f02725297a01944977c7741cef1a3887200b8fd761cb18cd9cae388937
MD5 hash:
0de9de1176d1d42ed657e68f3ea9e15d
SHA1 hash:
4f142ca4348a3ac4a547daff7c75ae71b03ab10f
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/37678ca4-f130-4b8d-9329-54c9e56e3f7f/
Parent samples :
336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441
f60d8bd3ca821e7de945f17d646654b7c0f25949aa8c6f780313925076444fc2
SH256 hash:
6c9096a17983d7a781dc157b0229004f17eaca19ea12504f1923a2eeb7c1bb27
MD5 hash:
8907e8410b451573ec61c6e3eb31c895
SHA1 hash:
254b9a7284e9090c4f34562ecf504fdda5882260
Link:
https://www.unpac.me/results/37678ca4-f130-4b8d-9329-54c9e56e3f7f/
SH256 hash:
336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441
MD5 hash:
d6c057e338fd2884d4ae0ff6a5026eb7
SHA1 hash:
e59718e913ec2f993a4c08e8098e9af8f00663c2
Link:
https://www.unpac.me/results/37678ca4-f130-4b8d-9329-54c9e56e3f7f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/336c374c048c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441

File information

The table below shows additional information about this malware sample such as delivery method and external references.

TrickBot

Java Script (JS) js f6a4af73637cba42f841b3934c6057e39290ad53a3b669b783f0958556680b06

TrickBot

DLL dll 336c374c048c503e3e4f6d5f3d357ca49cc5ecf0187378a3869edcc050b9d441

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/browse/tag/rob123/
  
Dropped by
MD5 a38c312063725e7d2e7966227ffbbde5
  
Dropped by
SHA256 f6a4af73637cba42f841b3934c6057e39290ad53a3b669b783f0958556680b06
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/179983/

Comments