MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71b4913ef363073f0ecc4b4c5af3ad4b4889ac7f22a3e34d54c9b6572b83c483. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71b4913ef363073f0ecc4b4c5af3ad4b4889ac7f22a3e34d54c9b6572b83c483
SHA3-384 hash: 85c0cd320f15faac711261562ed8833026b7ed4459e557cd4c35da2e9071e299c0ada482d55443c07a2c95e3bdb077f2
SHA1 hash: 97609b1d447453fa5e431f90668678ac8c090730
MD5 hash: 1da055b46fb0698f80a4404b3a3a63b3
humanhash: seven-mike-eleven-moon
File name:ExistingExcel.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:494'592 bytes
First seen:2021-03-09 18:50:24 UTC
Last seen:2021-03-09 20:51:22 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 2b5f348995ab84adca5770eb3a5f6f9f (1 x TrickBot)
ssdeep 12288:obfU4rj9nHECpvq6WP2wpPXZAN85/g7Q7LJc:S7kCpvm/PXk2/gcP
Threatray 1 similar samples on MalwareBazaar
TLSH F3B4C031F9A88402D8A81773ACA8FFD3E43D935C6F277757B26C059DCB608A16246B53
Reporter James_inthe_box
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
3
# of downloads :
245
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/123370/
Detection(s):
SecuriteInfo.com.generic.ml.24829.13308.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/633421
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 365684 Sample: ExistingExcel.dll Startdate: 09/03/2021 Architecture: WINDOWS Score: 64 37 Yara detected Trickbot 2->37 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 regsvr32.exe 8->15         started        signatures5 39 Writes to foreign memory regions 10->39 41 Allocates memory in foreign processes 10->41 17 wermgr.exe 10->17         started        20 cmd.exe 10->20         started        22 iexplore.exe 1 76 13->22         started        process6 signatures7 33 Tries to detect virtualization through RDTSC time measurements 17->33 35 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->35 24 iexplore.exe 156 22->24         started        process8 dnsIp9 27 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49742, 49743 YAHOO-DEBDE United Kingdom 24->27 29 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49736, 49737 FASTLYUS United States 24->29 31 9 other IPs or domains 24->31
Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 18:50:07 UTC
File Type:
PE (Sys)
AV detection:
7 of 28 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=og2jcpxtmmdt6dwmjngfv45njneitld7ekr6gtkuzg3fok4dysbq._file
Verdict:
unknown
Similar samples:
0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob73 banker trojan
Link:
https://tria.ge/reports/210309-dwteebedxa/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
06edd873a910928a3a4c6d83624be60cd9fdd38a5f1f1b3477579bd0d90222b1
MD5 hash:
9666914e895140ff816ade4e1884a618
SHA1 hash:
d0df98f35ce1cd0b179e3d967b18882dad5e6bd2
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/2d91c1eb-d166-4bf0-ad0a-8e18e2bb56bc/
SH256 hash:
965a7d1bbe3583bfb3afd7f77c2e8d1c371924a8055670b51cc9333a6fd63eee
MD5 hash:
597bc33e6d6cb8d533ee18d902e34eda
SHA1 hash:
0e21789a4497e073e21fe0f7a1dc9c4b47de74f9
Link:
https://www.unpac.me/results/2d91c1eb-d166-4bf0-ad0a-8e18e2bb56bc/
SH256 hash:
71b4913ef363073f0ecc4b4c5af3ad4b4889ac7f22a3e34d54c9b6572b83c483
MD5 hash:
1da055b46fb0698f80a4404b3a3a63b3
SHA1 hash:
97609b1d447453fa5e431f90668678ac8c090730
Link:
https://www.unpac.me/results/2d91c1eb-d166-4bf0-ad0a-8e18e2bb56bc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/71b4913ef363073f0ecc4b4c5af3ad4b4889ac7f22a3e34d54c9b6572b83c483

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/123370/
  
URLhaus
https://urlhaus.abuse.ch/url/1057592/
  
URLhaus
https://urlhaus.abuse.ch/url/1057591/

Comments