MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0
SHA3-384 hash: b317ce071165cd415be2a2df7e2d0fc08b2455307cc34b047c6f01f3b99d15baa75bb5133fd7c62639a5b1e2fce781c0
SHA1 hash: 7efc236d4804073a99337a7833b9536c358c49bc
MD5 hash: ae5a227472b36642f4325c2fd4f884f5
humanhash: bluebird-grey-oven-freddie
File name:ae5a227472b36642f4325c2fd4f884f5
Download: download sample
Signature TrickBot
Create hunting rule
File size:434'308 bytes
First seen:2021-09-15 15:08:39 UTC
Last seen:2021-09-15 16:20:21 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dd8144b08ab80db33cdc6fa6c39db0a4 (1 x TrickBot)
ssdeep 6144:werDAqRUaI8skxQtfrJ2X0qQGUGrGDHN2ixIOFVHRBxCRvhoajl/NnlV6:w4DAqR0RXjvGqDt2II2M/je
Threatray 1'024 similar samples on MalwareBazaar
TLSH T17294D00272829575D0BB127E08A61B5663BBBC61CFF59ADB23407B5DAE316C1DF31322
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter malwarelabnet
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/188223/
Detection(s):
SecuriteInfo.com.ML.PE-A.6767.11701.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/61751bae9a5a1e91c5d203bb/reports/a329e5d5-459d-4eee-8e0f-121c9d80f383/overview
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3558577-e2b0-44c8-af3b-6a0b982942a8
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/851526
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 483957 Sample: wOFgaJ3x3M Startdate: 15/09/2021 Architecture: WINDOWS Score: 96 82 Found malware configuration 2->82 84 Yara detected Trickbot 2->84 86 Machine Learning detection for sample 2->86 88 Sigma detected: Regsvr32 Command Line Without DLL 2->88 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        13 rundll32.exe 2->13         started        15 rundll32.exe 2->15         started        process3 signatures4 90 Writes to foreign memory regions 8->90 92 Allocates memory in foreign processes 8->92 17 regsvr32.exe 8->17         started        20 cmd.exe 1 8->20         started        22 rundll32.exe 8->22         started        24 2 other processes 8->24 process5 dnsIp6 72 Writes to foreign memory regions 17->72 74 Allocates memory in foreign processes 17->74 76 Queues an APC in another process (thread injection) 17->76 78 Delayed program exit found 17->78 27 wermgr.exe 2 17->27         started        80 Early bird code injection technique detected 20->80 31 rundll32.exe 20->31         started        33 wermgr.exe 3 22->33         started        52 14.102.15.100, 443, 49933, 49941 WORLDPHONE-INASNumberforInterdomainRoutingIN India 24->52 54 84.236.171.231, 443, 49825, 49828 SERVIHOSTING-ASAireNetworksES Spain 24->54 56 4 other IPs or domains 24->56 36 iexplore.exe 5 148 24->36         started        signatures7 process8 dnsIp9 58 176.100.4.31, 443, 49943, 49945 PAVUTYNA-ASUA Ukraine 27->58 60 103.65.193.144, 443, 50178, 50180 NRDATASERVICE-ASNRDATASERVICEPVTLTDIN India 27->60 66 3 other IPs or domains 27->66 94 Tries to detect virtualization through RDTSC time measurements 27->94 96 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 27->96 98 Writes to foreign memory regions 31->98 100 Allocates memory in foreign processes 31->100 102 Delayed program exit found 31->102 38 wermgr.exe 3 31->38         started        62 14.102.72.204, 443, 49884, 49890 WORLDPHONE-INASNumberforInterdomainRoutingIN India 33->62 64 14.102.188.227, 443, 49819, 49822 WORLD-ASWorldStarCommunicationIN India 33->64 68 3 other IPs or domains 33->68 42 C:\Users\user\AppData\...\oiwOFgaJ3x3Mwu.trd, PE32 33->42 dropped 70 11 other IPs or domains 36->70 file10 signatures11 process12 dnsIp13 46 36.91.36.29, 443, 50040, 50043 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID Indonesia 38->46 48 36.95.110.19, 443, 50206, 50211 TELKOMNET-AS-APPTTelekomunikasiIndonesiaID Indonesia 38->48 50 2 other IPs or domains 38->50 44 C:\Users\user\AppData\...\cawOFgaJ3x3Myu.trd, PE32 38->44 dropped file14
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
03b58de7881d04ca77d4e7473b5876b5b648f7366cd25b7f9bad4b851c22f201
TrickBot
03ff8ba48d53dfb76d0218df8762010303fd6c49524eab335cb2ecb90bfaf693
TrickBot
367cd9c4f987db35c45539316388a22110adff7b0d0e51f63ceb4034a0037bfb
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
9dbffb4b069247648835fbdbc7ee71d467ee258a37b05797e83facfe53e61015
TrickBot
b7da1ed4d4b5461005d4a9ec7e54c69bc4a86ba94571c0c61840987bf87af1ab
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
ff2e1604b5ab04fc43039d5f94d08073f756115b1018846a253c0ad93ed94f8b
TrickBot
+ 1'014 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zem1 banker trojan
Link:
https://tria.ge/reports/210915-sjgd3aahc4/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
103.36.126.221:443
84.236.171.231:443
14.102.72.204:443
176.100.4.31:443
165.73.90.187:443
103.23.237.6:443
122.117.90.133:443
103.61.100.252:443
36.95.110.19:443
103.65.193.144:443
117.220.229.162:443
103.113.105.126:443
14.102.46.9:443
139.255.199.196:443
157.119.215.186:443
151.106.48.226:443
36.91.36.29:443
117.196.235.194:443
14.102.188.227:443
103.75.32.38:443
45.116.106.45:443
103.94.0.178:443
117.204.253.199:443
117.212.195.251:443
14.102.15.100:443
203.115.106.98:443
117.252.69.134:443
103.127.67.38:443
117.212.192.15:443
103.61.100.117:443
103.122.108.44:443
103.47.170.149:443
36.37.99.242:443
103.93.176.237:443
103.61.100.10:443
14.102.15.101:443
Unpacked files
SH256 hash:
b861d1892d8ab1a0daa39d9e1d71442a34785abf68b1b81ca361db7a264b24ad
MD5 hash:
d1989832f214a10c7b6e9fba994c0208
SHA1 hash:
bbd410a8334f6b099f4e85088222b81caa269fd8
Link:
https://www.unpac.me/results/00f87be0-1181-4c29-9ce1-d26ba695ad71/
SH256 hash:
e56799dd3a0087b3c436326854cff7b6bf500ab8e183cf94e1382404e14429eb
MD5 hash:
52d981cf00eaedec0a93baf02c3aa49c
SHA1 hash:
72fde133b9c17d82b6e96602a4900305a9105d11
Link:
https://www.unpac.me/results/00f87be0-1181-4c29-9ce1-d26ba695ad71/
SH256 hash:
798c312703f475bb327093229c711c5797954cc0457dcf1464b42804d9199f8c
MD5 hash:
910258bf7a28cb335afeb9d2854871ac
SHA1 hash:
4cac206e373be5bc0fba0b61f1b16820f35edfce
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/00f87be0-1181-4c29-9ce1-d26ba695ad71/
SH256 hash:
05977ee5333492a3d80637d1df6a74c6b41ac86cd6436d493870d7142dfbf4d9
MD5 hash:
61298bd6265f181ad5f2b28c8df14a1c
SHA1 hash:
20ddbda6f087e9dce307eb91bffb9c47e05e9207
Link:
https://www.unpac.me/results/00f87be0-1181-4c29-9ce1-d26ba695ad71/
SH256 hash:
5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0
MD5 hash:
ae5a227472b36642f4325c2fd4f884f5
SHA1 hash:
7efc236d4804073a99337a7833b9536c358c49bc
Link:
https://www.unpac.me/results/00f87be0-1181-4c29-9ce1-d26ba695ad71/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/5cd5117a6e5c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5cd5117a6e5ce9208897678ed6c44bf821f02326b01386589e56e0adbe0581f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/188223/

Comments