🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c5eb6d4b99bdd95fba7618d5db719d2e4c1c107556203a2eef83c236320a1f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c5eb6d4b99bdd95fba7618d5db719d2e4c1c107556203a2eef83c236320a1f3
SHA3-384 hash: 201bf9081f7278aa400ffcdf64165079f0e8bf06c7941b90386cdf0295c099cb2ba4d8df8dacef9c58aaaa637d06b5a9
SHA1 hash: 74823493ff96539162fc752b76c0f0296f83d36b
MD5 hash: 1c2102da230d1ebe49df949ede0bf738
humanhash: skylark-monkey-lake-blue
File name:1c2102da_by_Libranalysis
Download: download sample
Signature TrickBot
Create hunting rule
File size:421'888 bytes
First seen:2021-05-24 14:02:29 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 145f081aec8f3ebb691562c6155ee3ed (1 x TrickBot)
ssdeep 6144:2KjMh5gPIz0WxXZYVBxtSN9ft8qB1FUJ4YaWKGDxzzQ2x36M3P6nl7Og:2KkmPIpXdzfFUwWKozxKl7Og
Threatray 153 similar samples on MalwareBazaar
TLSH 4294E00236E0817AD3BF127E4FB557209BBBB860DFF28A4B2F405E8D5D349555E29322
Reporter Libranalysis
Tags:TrickBot


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/161496/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/790456
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 422856 Sample: 1c2102da_by_Libranalysis.dll Startdate: 24/05/2021 Architecture: WINDOWS Score: 92 43 Found malware configuration 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected Trickbot 2->47 49 Yara detected Trickbot 2->49 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 8->15         started        signatures5 51 Writes to foreign memory regions 10->51 53 Allocates memory in foreign processes 10->53 17 wermgr.exe 10->17         started        20 rundll32.exe 13->20         started        22 wermgr.exe 15->22         started        process6 signatures7 33 May check the online IP address of the machine 17->33 35 Tries to detect virtualization through RDTSC time measurements 17->35 37 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->37 39 Writes to foreign memory regions 20->39 41 Allocates memory in foreign processes 20->41 24 wermgr.exe 20->24         started        process8 dnsIp9 27 212.200.25.118, 443, 49715 TELEKOM-ASRS Serbia 24->27 29 checkip.us-east-1.prod.check-ip.aws.a2z.com 52.20.197.7, 49717, 80 AMAZON-AESUS United States 24->29 31 7 other IPs or domains 24->31
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9c5eb6d4b99bdd95fba7618d5db719d2e4c1c107556203a2eef83c236320a1f3/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-05-24 11:50:05 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
203f34cede0e215ae0be083464e358957e907b43637c8ca7762a1ad4b2526e58
TrickBot
2f2dc3b13b954e9b3286d8b1856c8e31ab9003ce999deebd9037ee83e5604b78
TrickBot
468cd4b5d89425cd29bb028696804ed339eb2c0c37b010b62442fbb5a8f778ba
TrickBot
678de819abf5f00b28eaaa8239169a08a75050a4df26fe3ce5b262d6c7b6cb24
TrickBot
697dea4b154178e8de096c66167b539aa4465155d294b11765f1a1886eb7c56d
TrickBot
7806c5adbd597c7c21ae08f3ca6c65a98df2ae314f033ad57ae8708c930a4af2
TrickBot
a8f0fe4419ee163d9230feca6a00693c5f61948159fe869ead51ec3398b7038d
TrickBot
c22df6708ee597cfbc4079d96503e8159104cdf1f0d3a9fecb6741a9e152d0b2
TrickBot
d1fd867dd79bb803974e18598bdc97cbb8f51acffeb8739ce2f01dff29985803
TrickBot
e283651e374533499d1552b94005f00360fda4f267f46d719bb6b02e8764243b
TrickBot
+ 143 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob87 banker trojan
Link:
https://tria.ge/reports/210524-nqgeg14mzj/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
196.43.106.38:443
186.97.172.178:443
37.228.70.134:443
144.48.139.206:443
190.110.179.139:443
172.105.15.152:443
177.67.137.111:443
27.72.107.215:443
186.66.15.10:443
189.206.78.155:443
202.131.227.229:443
185.9.187.10:443
196.41.57.46:443
212.200.25.118:443
197.254.14.238:443
45.229.71.211:443
181.167.217.53:443
181.129.116.58:443
185.189.55.207:443
172.104.241.29:443
14.241.244.60:443
144.48.138.213:443
202.138.242.7:443
202.166.196.111:443
36.94.100.202:443
187.19.167.233:443
181.129.242.202:443
36.94.27.124:443
43.245.216.116:443
186.225.63.18:443
41.77.134.250:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9c5eb6d4b99bdd95fba7618d5db719d2e4c1c107556203a2eef83c236320a1f3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/161496/

Comments