MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011
SHA3-384 hash: 30b34238416d8cce8400a5403b0fb7db85f8f012520123875955aee40c0010181836eddcbeb169d42e7f1974ff06cf78
SHA1 hash: a2bfa5bcf49ad7ac0cce9cfad21cfa320f7063e7
MD5 hash: e2936c63d59cee0853f9d50fc857813c
humanhash: saturn-papa-oregon-earth
File name:SecuriteInfo.com.Variant.Razy.848795.31184.234
Download: download sample
Signature TrickBot
Create hunting rule
File size:561'152 bytes
First seen:2021-03-02 09:27:41 UTC
Last seen:2021-03-02 09:54:21 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a13b670b0187f8bfc8c922a515c89a26 (1 x TrickBot)
ssdeep 12288:AAlaPYBoG7DahJtrJRp6dVEkuIhne29qbE/8luhL:hbSG/ededVE772OU8luh
TLSH 4EC4D031F5988412C4FA1A3728B0FFC3DA69E7AD9F21575B723C469C8F648A1475AB03
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/120874/
Detection(s):
SecuriteInfo.com.Variant.Razy.848795.31184.234.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/623714
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 360843 Sample: SecuriteInfo.com.Variant.Ra... Startdate: 02/03/2021 Architecture: WINDOWS Score: 84 28 123.200.26.246 LINK3-TECH-AS-BD-APLink3TechnologiesLtdBD Bangladesh 2->28 30 122.2.28.70 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH Philippines 2->30 32 2 other IPs or domains 2->32 44 Found malware configuration 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected Trickbot 2->48 50 C2 URLs / IPs found in malware configuration 2->50 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 cmd.exe 1 9->14         started        16 regsvr32.exe 9->16         started        signatures6 52 Writes to foreign memory regions 11->52 54 Allocates memory in foreign processes 11->54 18 wermgr.exe 11->18         started        21 wermgr.exe 11->21         started        23 iexplore.exe 2 84 14->23         started        process7 signatures8 40 Tries to detect virtualization through RDTSC time measurements 18->40 42 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 18->42 25 iexplore.exe 5 153 23->25         started        process9 dnsIp10 34 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49745, 49746 YAHOO-DEBDE United Kingdom 25->34 36 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49739, 49740 FASTLYUS United States 25->36 38 11 other IPs or domains 25->38
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011/
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2021-03-02 07:48:41 UTC
File Type:
PE (Dll)
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ig2osoq52g2j4er3drfidxdl4jtml7xf6mzghpnx4pfj4gt4iaiq._file
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon94 banker trojan
Link:
https://tria.ge/reports/210302-6dd6dxj1ts/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
df1f4578aaaee9ba03486f4b536ee957461292cb3ab1e17f3737a563770a3bef
MD5 hash:
0b9dce461ca5f021977a1782230849cd
SHA1 hash:
70360e90e12969731d2952d95ddd388f3b40268e
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/820902b9-461b-4e07-856d-d3f56ff4a12a/
SH256 hash:
9d2d084ed09653180c53941126f5bb4f1f0b49b3ed76177a1c96d3b8f9c5657a
MD5 hash:
c869834983bef91b32eba5352d0e2450
SHA1 hash:
8d40b7c09be21c4e701b9207019632c841d91fa5
Link:
https://www.unpac.me/results/820902b9-461b-4e07-856d-d3f56ff4a12a/
SH256 hash:
41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011
MD5 hash:
e2936c63d59cee0853f9d50fc857813c
SHA1 hash:
a2bfa5bcf49ad7ac0cce9cfad21cfa320f7063e7
Link:
https://www.unpac.me/results/820902b9-461b-4e07-856d-d3f56ff4a12a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 41b4e93a1dd1b49e123b1c4a81dc6be266c5fee5f33263bdb7e3ca9e1a7c4011

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/120874/
  
URLhaus
https://urlhaus.abuse.ch/url/1041769/
  
Delivery method
Distributed via web download

Comments