🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba
SHA3-384 hash: 7706eb7be580c006e84e1ff982d644d883244f92c5eb13e55232d58f2317c02875bead708ccb808597cc4db49bc4961f
SHA1 hash: c3b7ff6ab811df23c6f116d4566c819665685393
MD5 hash: c5d74107de9630e130f8cfcf53658ea6
humanhash: papa-freddie-berlin-missouri
File name:nameTpl.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:3'099'782 bytes
First seen:2021-06-29 02:19:10 UTC
Last seen:2021-06-29 03:22:50 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e877652137f9a4cc34a0b63661b3ba6a (8 x TrickBot)
ssdeep 49152:bX85+GzBYx5ulXJyA889lRN2G6tEw1um7WHgKLES5fQC4NIINE67Qg3ErgbJwaTn:/ISulgA889lRN2G6mwggUrgbJyaB7
Threatray 9 similar samples on MalwareBazaar
TLSH 89E56D21E900903AF6EB00FBC3F7457DAD789B20131560D742C479EAEB66DD97932A27
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/168649/
Detection(s):
SecuriteInfo.com.VHO.Trojan-Banker.Win32.Trickster.gen.10719.31679.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/882dd45d-63b5-4a89-bfa0-18655903ddc3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/809087
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hijacks the control flow in another process
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441494 Sample: nameTpl.jpg Startdate: 29/06/2021 Architecture: WINDOWS Score: 84 58 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->58 60 Multi AV Scanner detection for submitted file 2->60 8 loaddll32.exe 1 2->8         started        process3 signatures4 66 Writes to foreign memory regions 8->66 68 Allocates memory in foreign processes 8->68 11 wermgr.exe 8->11         started        15 regsvr32.exe 8->15         started        17 iexplore.exe 1 73 8->17         started        19 2 other processes 8->19 process5 dnsIp6 52 190.109.204.126, 443, 49782, 49803 METROREDSADECVHN Honduras 11->52 54 119.202.8.249, 443, 49769, 49780 KIXS-AS-KRKoreaTelecomKR Korea Republic of 11->54 56 8 other IPs or domains 11->56 70 Hijacks the control flow in another process 11->70 72 Writes to foreign memory regions 11->72 74 Tries to detect virtualization through RDTSC time measurements 11->74 76 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 11->76 21 cmd.exe 11->21         started        26 WerFault.exe 23 9 15->26         started        28 iexplore.exe 152 17->28         started        30 rundll32.exe 19->30         started        32 WerFault.exe 19->32         started        signatures7 process8 dnsIp9 44 12.23.113.92, 443, 49804 ATT-INTERNET4US United States 21->44 38 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 21->38 dropped 40 C:\Users\user\AppData\...\Login Data.bak, SQLite 21->40 dropped 42 C:\Users\user\AppData\Local\...\History.bak, SQLite 21->42 dropped 62 Tries to harvest and steal browser information (history, passwords, etc) 21->62 34 conhost.exe 21->34         started        64 Tries to evade analysis by execution special instruction which cause usermode exception 26->64 46 prod.appnexus.map.fastly.net 151.101.1.108, 443, 49767, 49768 FASTLYUS United States 28->46 48 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49761, 49762 FASTLYUS United States 28->48 50 11 other IPs or domains 28->50 36 WerFault.exe 17 9 30->36         started        file10 signatures11 process12
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-06-29 01:14:00 UTC
AV detection:
7 of 29 (24.14%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
TrickBot
32a8d650cdb03abcc979011c25a18411afc65a7e8012e8c1a6cb4125ba6d83aa
TrickBot
8368a955dd5d9850ed8ced6144a202368c52e065abafdb71a7960d3a90647e85
TrickBot
97c1deed13a9dba0c5834c3961ec93f96897e45e56f1c86a641427228830fcd4
TrickBot
afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc
TrickBot
b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28
TrickBot
b827fde51c75a1c5a400dd99d5b345f946874d77587384d31e3ca188364e92a4
TrickBot
c601014207780cd2448d3953272a43cacc9252bc86b365b7869af2a6a2ab3c09
TrickBot
d9246658c652dfdbd5072768db4183dd4a032184b0c3c9adc014687ad60b13d2
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev1 banker trojan
Link:
https://tria.ge/reports/210629-srk97lr22a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
d74438ba6ce59d50531b9e5396b9ac911dfd1a5c02d84698940836c16d30f615
MD5 hash:
0d9285e6e7e1adf77a48b8c72b21cf27
SHA1 hash:
ef26edf4573c161e2e0d84136f2a03790acbbef0
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/a6a58314-d882-413e-86f1-280fb791159f/
Parent samples :
8368a955dd5d9850ed8ced6144a202368c52e065abafdb71a7960d3a90647e85
9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba
b827fde51c75a1c5a400dd99d5b345f946874d77587384d31e3ca188364e92a4
c601014207780cd2448d3953272a43cacc9252bc86b365b7869af2a6a2ab3c09
b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28
97c1deed13a9dba0c5834c3961ec93f96897e45e56f1c86a641427228830fcd4
0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
SH256 hash:
8bf5e31d297f2717301dad09d911bfbd7b9ad99074b219a1e9f1763f30a066f4
MD5 hash:
eb1d4d672d784bb9ac01859455c338d9
SHA1 hash:
58493b80d560ea9c5e747cc293fcc44207de04db
Link:
https://www.unpac.me/results/a6a58314-d882-413e-86f1-280fb791159f/
SH256 hash:
9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba
MD5 hash:
c5d74107de9630e130f8cfcf53658ea6
SHA1 hash:
c3b7ff6ab811df23c6f116d4566c819665685393
Link:
https://www.unpac.me/results/a6a58314-d882-413e-86f1-280fb791159f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/168649/

Comments