MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8eb708fb8f044596b841b47c2d75f6c02f878f5685b75008084c70752b961d15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8eb708fb8f044596b841b47c2d75f6c02f878f5685b75008084c70752b961d15
SHA3-384 hash: 320a6d6f3dd2642b1a9ad00c3794e61018c5859b441176fe4794cf445a6adde3cc6059919de25c0ba656864517ff812e
SHA1 hash: f8d735d2a6890849c8b5bed15eaf70d7c73a47a7
MD5 hash: 9b9cdac0500794c369a3275624b37899
humanhash: montana-hotel-bulldog-white
File name:aeygwtpv.nao
Download: download sample
Signature TrickBot
Create hunting rule
File size:380'928 bytes
First seen:2021-07-20 15:51:11 UTC
Last seen:2021-07-20 16:52:16 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 41a307bd88c4387a8b1e9c4794ec8da4 (1 x TrickBot)
ssdeep 6144:5LcM+7gNFJxzUEdGSA1uJDM3MlXDeWz+e5or9k:5gM+7Sx4Eg71uJD7Rd/k
Threatray 844 similar samples on MalwareBazaar
TLSH T16F84E101B2E08475D1EF163D0E6E9739A3BBBDA0CEB0CE875B109A5D6D329509E35327
Reporter malware_traffic
Tags:dll gtag mod8 mod8 TrickBot


Avatar
malware_traffic
Run method: rundll32.exe [filename],StartW

Intelligence

File Origin
# of uploads :
2
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172864/
Detection(s):
SecuriteInfo.com.generic.ml.22827.16093.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0cfad6a7-2444-4709-bcaf-47d4b4fdd850
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/819081
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hijacks the control flow in another process
May check the online IP address of the machine
Sigma detected: CobaltStrike Load by Rundll32
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 451492 Sample: aeygwtpv.nao Startdate: 20/07/2021 Architecture: WINDOWS Score: 84 67 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->67 69 Sigma detected: CobaltStrike Load by Rundll32 2->69 10 loaddll32.exe 1 2->10         started        12 rundll32.exe 2->12         started        14 rundll32.exe 2->14         started        process3 process4 16 rundll32.exe 10->16         started        19 cmd.exe 1 10->19         started        21 rundll32.exe 10->21         started        signatures5 61 Writes to foreign memory regions 16->61 63 Allocates memory in foreign processes 16->63 65 Delayed program exit found 16->65 23 wermgr.exe 16->23         started        27 cmd.exe 16->27         started        29 rundll32.exe 19->29         started        31 wermgr.exe 21->31         started        33 cmd.exe 21->33         started        process6 dnsIp7 55 190.61.43.241, 443, 49748 UFINETPANAMASAPA Colombia 23->55 57 77.53.134.245, 443, 49741 SE-A3httpwwwa3seSE Sweden 23->57 59 9 other IPs or domains 23->59 75 May check the online IP address of the machine 23->75 77 Tries to detect virtualization through RDTSC time measurements 23->77 79 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 23->79 35 cmd.exe 1 23->35         started        81 Writes to foreign memory regions 29->81 83 Allocates memory in foreign processes 29->83 37 wermgr.exe 29->37         started        41 cmd.exe 29->41         started        signatures8 process9 dnsIp10 43 conhost.exe 35->43         started        49 148.235.154.164, 443, 49734 UninetSAdeCVMX Mexico 37->49 51 38.110.100.104, 443, 49722, 49733 BELAIR-TECHNOLOGIESCA United States 37->51 53 7 other IPs or domains 37->53 71 Hijacks the control flow in another process 37->71 73 Writes to foreign memory regions 37->73 45 cmd.exe 1 37->45         started        signatures11 process12 process13 47 conhost.exe 45->47         started       
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/8eb708fb8f044596b841b47c2d75f6c02f878f5685b75008084c70752b961d15/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
458844d1edad3253667e6eea0dc735a748e87ff784cbf12c80f05c15e96ec3d9
TrickBot
6b9c6a3cb61aa69e521120369f8d4bfbc91a4259dfe79996a512e2a1c3cd85ef
TrickBot
7d6688ec15f6fec19a2cc6743f3fe50f5dcf79d14f122f3ebdf844464c45abec
TrickBot
8a5ab991e0f8318707d517aee2a9a0689b5908050e17b6afce77e83544fcaaa8
TrickBot
c3f153bb4b44d9e0cb3cab0bf7eed03b8eea280b97756937dedbe74c7013a3d3
TrickBot
cc874aecc69d4a5b5694f59c3896fe36ec29a44ce77e4f07c7cd5ec9f3b04688
TrickBot
e70bf6458eee2cfcf961aa219af2296cf14df04a9dbb3686ddcde1478fe38265
TrickBot
f95adae1cd46200a5b9d61024e3eb887bfacfe2fe63b94f1dc4e6b89edb9cae3
TrickBot
fccb8dea9ab7e194eadc863a8e7658b9076fddd4b645b4241ab5b9a33997afcc
TrickBot
+ 834 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mod8 banker trojan
Link:
https://tria.ge/reports/210720-4pbswzqpv6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
Unpacked files
SH256 hash:
0cd813f2a798adaf7433a2bad00cc47c2c17bcb84f5b51951be84d5def29ff5b
MD5 hash:
00b9277b9dbfbb7a192ee42f0b283dbb
SHA1 hash:
d581daa3e6c351c450fc4b69c5b08e80e20bc088
Link:
https://www.unpac.me/results/1661fc0e-9522-4d59-a699-684f46f7f5cc/
SH256 hash:
c4740052c65baa0f8f06e67a43a648d8f41b146eebff4963bb80fd8d5a2639ea
MD5 hash:
31363d9659fe4f7aa71670716f658e9d
SHA1 hash:
938f440ae4ab944cb2de77cea8de5770293e0d25
Link:
https://www.unpac.me/results/1661fc0e-9522-4d59-a699-684f46f7f5cc/
SH256 hash:
f308268d35424cb6755442c870fea683612f07c4f32b15aa29525d7a2cc38522
MD5 hash:
54ad5298743583704d2e7d4e4c1eff14
SHA1 hash:
772d76f7a42b8f91bac136f3459f97629f8f0bae
Link:
https://www.unpac.me/results/1661fc0e-9522-4d59-a699-684f46f7f5cc/
SH256 hash:
2e362a566d2d2fa5ca041e858375a98619c3bdcf7d6109bc62a9296119425304
MD5 hash:
cdde1f75cb37f1c8b7f42632be0432f8
SHA1 hash:
15516a6122f0c056739aae5d67d76c9797a3a1cd
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/1661fc0e-9522-4d59-a699-684f46f7f5cc/
Parent samples :
8eb708fb8f044596b841b47c2d75f6c02f878f5685b75008084c70752b961d15
ade2a738f75f052722923641168d0b3862981e0dd23b31834c1520123a73be49
SH256 hash:
8eb708fb8f044596b841b47c2d75f6c02f878f5685b75008084c70752b961d15
MD5 hash:
9b9cdac0500794c369a3275624b37899
SHA1 hash:
f8d735d2a6890849c8b5bed15eaf70d7c73a47a7
Link:
https://www.unpac.me/results/1661fc0e-9522-4d59-a699-684f46f7f5cc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8eb708fb8f044596b841b47c2d75f6c02f878f5685b75008084c70752b961d15

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172864/

Comments