🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677
SHA3-384 hash: 0ced71bff6161a0e9e7737fa0e52950a285ae713b2297dfe493fd9663c9c3a42577c829e2a7df320f757f6aa7d5b79c5
SHA1 hash: fea67687d4fd185246267305a76b53060407c7e9
MD5 hash: 55ee6dca51e918bd51a000b0899e275a
humanhash: cola-kansas-pluto-magazine
File name:55ee6dca51e918bd51a000b0899e275a
Download: download sample
Signature TrickBot
Create hunting rule
File size:755'712 bytes
First seen:2021-10-07 07:06:33 UTC
Last seen:2021-10-07 08:06:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e94090a99a943b0e253b62a04e66d644 (1 x TrickBot)
ssdeep 6144:uxkqYmlu8xpGrCYEmAO4sYb3+KnQk+pf4RZp1BpY6z1:uuqYmE8lm+HbH1Ef4RZTsW1
Threatray 3 similar samples on MalwareBazaar
TLSH T1E6F4CBF8AC20D695F896B5BAE8D0B84500017CBC75AF8F850554BB3E39E74849F989CF
Reporter zbetcheckin
Tags:32 dll exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
232
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195638/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.15644.106.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware monero
Link:
https://www.filescan.io/uploads/615e9c9fb95458900cdde1ce/reports/b6f2a9d1-3cd6-4d27-a153-62553aa06276/overview
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/866080
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Regsvr32 Command Line Without DLL
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 498508 Sample: 3JWv5bYojD Startdate: 07/10/2021 Architecture: WINDOWS Score: 88 53 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->53 55 Antivirus detection for URL or domain 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 2 other signatures 2->59 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        process3 signatures4 69 Writes to foreign memory regions 8->69 71 Allocates memory in foreign processes 8->71 13 rundll32.exe 8->13         started        16 cmd.exe 1 8->16         started        18 iexplore.exe 1 74 8->18         started        20 3 other processes 8->20 process5 signatures6 73 Writes to foreign memory regions 13->73 75 Allocates memory in foreign processes 13->75 22 wermgr.exe 13->22         started        26 cmd.exe 13->26         started        28 rundll32.exe 16->28         started        30 iexplore.exe 2 159 18->30         started        32 WerFault.exe 23 9 20->32         started        process7 dnsIp8 45 46.99.175.149, 443, 49880, 49886 IPKO-ASAL Albania 22->45 61 Tries to detect virtualization through RDTSC time measurements 22->61 63 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 22->63 65 Writes to foreign memory regions 28->65 67 Allocates memory in foreign processes 28->67 34 wermgr.exe 28->34         started        37 cmd.exe 28->37         started        47 pixel-origin.mathtag.com 185.29.134.244, 443, 49802, 49803 MEDIAMATH-INCUS United Kingdom 30->47 49 cm.g.doubleclick.net 172.217.168.2, 443, 49791, 49792 GOOGLEUS United States 30->49 51 29 other IPs or domains 30->51 signatures9 process10 dnsIp11 39 185.56.175.122, 443, 49881, 49883 VIRTUAOPERATOR-ASPL Poland 34->39 41 5.152.175.57, 443, 49893, 50051 SKYLOGIC-ASIT Spain 34->41 43 4 other IPs or domains 34->43
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 02:22:00 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
91c09eab3e0328874c32b21673a61d4e591267c537a9d1cafa8ae92350323073
TrickBot
fd083bc2dbc3426a332eaf861dea03c648ad04cb73ba8f09504c970af9134898
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:soc1 banker trojan
Link:
https://tria.ge/reports/211007-hxpmgsbhg8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
4ab5ffc26e36988137831cc44fd2faf4e130ac368b5962afbddf23cba7101e14
MD5 hash:
50f0efe9cf52a0e3a934f489b9a67af1
SHA1 hash:
aa61dc5828045e38fc60d8d0b409bb5070aae42a
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/68b41d05-8cf1-420a-bd8d-65f5d97ce99a/
SH256 hash:
702f3050901a039675745a037199c0f74e84dc17ec6c52ead3a4eb206cabdc47
MD5 hash:
d0d237f06effd6b5bd80a82cfd1798df
SHA1 hash:
71fc69f9467969e0a414ed393a50682789244648
Link:
https://www.unpac.me/results/68b41d05-8cf1-420a-bd8d-65f5d97ce99a/
SH256 hash:
72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677
MD5 hash:
55ee6dca51e918bd51a000b0899e275a
SHA1 hash:
fea67687d4fd185246267305a76b53060407c7e9
Link:
https://www.unpac.me/results/68b41d05-8cf1-420a-bd8d-65f5d97ce99a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/72534ec2c4fc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1659218/
Cape
Cape
https://www.capesandbox.com/analysis/195638/

Comments


Avatar
zbet commented on 2021-10-07 07:06:34 UTC

url : hxxps://acera.co.uk/1.dll