MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3
SHA3-384 hash: 2e27d700b8986fca8280ce8d0b73636c28babcc7d613b1c1500befc019f211cd23f795aece9678ebc6973a1c6958e352
SHA1 hash: 087fc2a88aa3bc8359d66883910d8e67247bda79
MD5 hash: 3445345404d79d21309dbb82ac17406c
humanhash: bakerloo-carpet-leopard-ink
File name:3445345404d79d21309dbb82ac17406c
Download: download sample
Signature TrickBot
Create hunting rule
File size:704'512 bytes
First seen:2021-10-14 20:12:27 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash c3999372aa5e8132ef67e26a98a6ced3 (4 x TrickBot)
ssdeep 12288:mUOGe6UVreQJtjqiI1DxynlwwxqXIFW2FUwoOvWmM/:i6UVr9oiuxqlwwhs2TbW3/
Threatray 4'278 similar samples on MalwareBazaar
TLSH T1B2E4BF02F2D1C036C1AE16345E166B55A3EDFD905E79C687FB88AB4F1E31AC19A35323
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter zbetcheckin
Tags:32 dll exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
367
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197629/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/61688f4ffd35fe780c40e9d2/reports/ff923a43-0c34-493e-a4b4-9270f993a135/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e04671c1-70b6-43fc-abe3-d8d3d09ca770
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/870760
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 503188 Sample: y3Eyagf9Ft Startdate: 14/10/2021 Architecture: WINDOWS Score: 96 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Trickbot 2->50 8 loaddll32.exe 1 2->8         started        10 rundll32.exe 2->10         started        process3 process4 12 rundll32.exe 8->12         started        15 cmd.exe 1 8->15         started        17 rundll32.exe 8->17         started        signatures5 62 Writes to foreign memory regions 12->62 64 Allocates memory in foreign processes 12->64 66 Queues an APC in another process (thread injection) 12->66 19 wermgr.exe 12->19         started        23 cmd.exe 12->23         started        25 rundll32.exe 15->25         started        27 wermgr.exe 17->27         started        29 cmd.exe 17->29         started        process6 dnsIp7 36 105.27.205.34, 443, 49763, 49846 SEACOM-ASMU Mauritius 19->36 38 128.201.76.252, 443, 49752, 49755 PedroFArrudaJuniorMEBR Brazil 19->38 40 4 other IPs or domains 19->40 52 May check the online IP address of the machine 19->52 54 Tries to detect virtualization through RDTSC time measurements 19->54 56 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 19->56 58 Writes to foreign memory regions 25->58 60 Allocates memory in foreign processes 25->60 31 wermgr.exe 25->31         started        34 cmd.exe 25->34         started        signatures8 process9 dnsIp10 42 65.152.201.203, 443, 49753, 49845 CENTURYLINK-US-LEGACY-QWESTUS United States 31->42
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qu245zlbp23seohycpxtv2miivmmphh5zycbexq233bqbephu6zq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252
TrickBot
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e
TrickBot
6cdc36e5c8774b62bbeeaa2141af5fd3c9c5ca33e0197e6301f76f23e59e9e22
TrickBot
9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2
TrickBot
be6f52a5ec95249cc20be5224a6c1e759e06a447c7996b98d063308d3077a2d0
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
+ 4'268 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:sof1 banker suricata trojan
Link:
https://tria.ge/reports/211014-yzd7jabacn/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
suricata: ET MALWARE Win32/TrickBot CnC Initial Checkin M2
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
295979d0d4eae3debf6f78a7b971de28f0671d7efcac845da9bb97a342b11b7a
MD5 hash:
41b4d09c270421d2049ce0bb752ba1f3
SHA1 hash:
c26e42c3257db3c071f4b2ecf60c5e8865240afb
Link:
https://www.unpac.me/results/271e59f8-7896-4e89-b1df-934403ca4d9d/
SH256 hash:
72c477c7ce3f96e9a6e5f3fe03045cee10c7eaaeead986afe686c224d09a4e5c
MD5 hash:
4e078636f76753ac6167653ac9e1b958
SHA1 hash:
8b5bca5b710024780de36b60b3431003f9f81325
Link:
https://www.unpac.me/results/271e59f8-7896-4e89-b1df-934403ca4d9d/
SH256 hash:
8d88a5e9d338e6e3c84f5af97fa79889930ad4f2cbe12528347a2dc0c0b17bab
MD5 hash:
101d25118f0670f12d98d3b47aba9d44
SHA1 hash:
233b6b55a2492a0112a05072d728efde28c662cf
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/271e59f8-7896-4e89-b1df-934403ca4d9d/
Parent samples :
14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2
be6f52a5ec95249cc20be5224a6c1e759e06a447c7996b98d063308d3077a2d0
8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3
SH256 hash:
e2de4de3147a386f1e9b2d020438e1dcf42219c562541b81b5e056a8d616e9aa
MD5 hash:
b02f4cf6da8ae9f18d9a71f3e0291549
SHA1 hash:
18b8e4881b51ba8117b1760f02247a007a7f6669
Link:
https://www.unpac.me/results/271e59f8-7896-4e89-b1df-934403ca4d9d/
SH256 hash:
8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3
MD5 hash:
3445345404d79d21309dbb82ac17406c
SHA1 hash:
087fc2a88aa3bc8359d66883910d8e67247bda79
Link:
https://www.unpac.me/results/271e59f8-7896-4e89-b1df-934403ca4d9d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8535cee5617e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197629/

Comments


Avatar
zbet commented on 2021-10-14 20:12:30 UTC

url : hxxp://195.133.192.101/images/redplane.png