MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3
SHA3-384 hash: b8f0b054dc3a3e06ca220b0fc27fa0c53fa5e72d475f0362f84a00483aa1936530eb820540248541614163858bd19d53
SHA1 hash: f80d082737757b3b3472f2cfa3abdf0d0255bcbe
MD5 hash: d8fbf9107309000bdd8ed618c20690cc
humanhash: kitten-river-fanta-quebec
File name:SecuriteInfo.com.Variant.Zusy.370751.7551.3147
Download: download sample
Signature TrickBot
Create hunting rule
File size:495'616 bytes
First seen:2021-03-16 08:50:37 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b5c8d37549a784c0c565febea0373025 (2 x TrickBot)
ssdeep 12288:8gNf8MMYejGMR3BJHCnTsAe3G93/A39/L:3uMMljGMRRonTDe3EPIL
Threatray 2 similar samples on MalwareBazaar
TLSH 26B4C030F9684802C8ED1BB36CA5FFC3E43D93AE2F527657F77C4A8D96508616286613
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Zusy.370751.7551.3147.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6ef3ae02-f1fd-4e66-b9f8-fbfa5b725296
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/640473
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 369210 Sample: SecuriteInfo.com.Variant.Zu... Startdate: 16/03/2021 Architecture: WINDOWS Score: 72 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Trickbot 2->39 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 regsvr32.exe 8->15         started        signatures5 41 Writes to foreign memory regions 10->41 43 Allocates memory in foreign processes 10->43 17 wermgr.exe 10->17         started        20 cmd.exe 10->20         started        22 iexplore.exe 2 84 13->22         started        process6 signatures7 33 Tries to detect virtualization through RDTSC time measurements 17->33 35 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->35 24 iexplore.exe 5 150 22->24         started        process8 dnsIp9 27 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49741, 49742 YAHOO-DEBDE United Kingdom 24->27 29 prod.appnexus.map.fastly.net 151.101.1.108, 443, 49736, 49737 FASTLYUS United States 24->29 31 12 other IPs or domains 24->31
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2021-03-12 07:22:21 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgaqe3nadxbnwouvp76rcm3uyk2ef2ozlhvu46evboidvhskw3rq._file
Verdict:
unknown
Similar samples:
0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb
TrickBot
cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon118 banker trojan
Link:
https://tria.ge/reports/210316-96dtz6q8k2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
8279e2966209c8a371cc9d3b993bdfbc0ce7b15bce2243807a4ed73acc3bd133
MD5 hash:
d9ad93e30f52bfd86e9afa631e6d0ed6
SHA1 hash:
5ed168251f4994d5c8e4ed341c5aa8afa0a286a5
Link:
https://www.unpac.me/results/fa378afe-22d5-478d-a1fb-079411728be2/
SH256 hash:
c6dfee2d525bfaf47c252d1792d79f1b3dca107dec625b4e17d17bdf28e8526e
MD5 hash:
c52ee70ba697d06866775f9d40c407c6
SHA1 hash:
f9204c726ef5274d63774b227edbf89465b49996
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/fa378afe-22d5-478d-a1fb-079411728be2/
SH256 hash:
3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3
MD5 hash:
d8fbf9107309000bdd8ed618c20690cc
SHA1 hash:
f80d082737757b3b3472f2cfa3abdf0d0255bcbe
Link:
https://www.unpac.me/results/fa378afe-22d5-478d-a1fb-079411728be2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1070394/
  
Delivery method
Distributed via web download

Comments