MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2
SHA3-384 hash: f7b48c473e16152d7e03e2ece9aa3e367d89f1797c1614d94386efccc094eb4032d580d97e52e05cf3720f46da74ffda
SHA1 hash: 88f07c32077c812ef08827141eabcc15fc1d142a
MD5 hash: 463576e11c092968f3ee4f0686f7210d
humanhash: maine-music-wisconsin-monkey
File name:463576e11c092968f3ee4f0686f7210d
Download: download sample
Signature TrickBot
Create hunting rule
File size:704'512 bytes
First seen:2021-10-14 18:27:02 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash c3999372aa5e8132ef67e26a98a6ced3 (4 x TrickBot)
ssdeep 12288:mUOGe6UVreQJtjqiI1DxynlwwxqXIdW2FUwoOvWmM/:i6UVr9oiuxqlwwhU2TbW3/
Threatray 4'275 similar samples on MalwareBazaar
TLSH T129E4BF02F2D1C036C1AE16345E166B55A3EDFD905E79C687FB88AB4F1E31AC19A35323
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter zbetcheckin
Tags:32 dll exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
357
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197616/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger packed
Link:
https://www.filescan.io/uploads/6168767e1c2d58ba7406c949/reports/0dd4b70b-55c3-4cf5-85f0-4a5fcca0f93c/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/371bba1b-0575-48f0-b540-4e7d779d6892
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/870714
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Uses ipconfig to lookup or modify the Windows network settings
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 503143 Sample: LsReqBuu7z Startdate: 14/10/2021 Architecture: WINDOWS Score: 100 78 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->78 80 Found malware configuration 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 3 other signatures 2->84 10 loaddll32.exe 1 2->10         started        12 rundll32.exe 2->12         started        process3 process4 14 rundll32.exe 10->14         started        17 cmd.exe 1 10->17         started        19 rundll32.exe 10->19         started        signatures5 96 Writes to foreign memory regions 14->96 98 Allocates memory in foreign processes 14->98 100 Queues an APC in another process (thread injection) 14->100 21 wermgr.exe 3 14->21         started        26 cmd.exe 14->26         started        28 rundll32.exe 17->28         started        process6 dnsIp7 64 46.99.175.217, 443, 49758, 49760 IPKO-ASAL Albania 21->64 66 182.253.210.130, 443, 49766, 49772 BIZNET-AS-APBIZNETNETWORKSID Indonesia 21->66 68 5 other IPs or domains 21->68 54 C:\Users\user\AppData\...\fhLsReqBuu7zbp.dmo, PE32 21->54 dropped 86 Hijacks the control flow in another process 21->86 88 May check the online IP address of the machine 21->88 90 Writes to foreign memory regions 21->90 94 2 other signatures 21->94 30 svchost.exe 11 21->30         started        35 svchost.exe 21->35         started        37 svchost.exe 21->37         started        39 wermgr.exe 26->39         started        41 cmd.exe 26->41         started        92 Allocates memory in foreign processes 28->92 43 wermgr.exe 28->43         started        45 cmd.exe 28->45         started        file8 signatures9 process10 dnsIp11 70 203.109.82.172, 443, 49788, 49814 YOU-INDIA-APYOUBroadbandCableIndiaLtdIN India 30->70 72 103.201.142.30, 443, 49785, 49811 WORLD-ASWorldStarCommunicationIN India 30->72 74 24 other IPs or domains 30->74 56 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 30->56 dropped 58 C:\Users\user\AppData\...\Login Data.bak, SQLite 30->58 dropped 60 C:\Users\user\AppData\Local\...\History.bak, SQLite 30->60 dropped 62 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 30->62 dropped 76 Tries to harvest and steal browser information (history, passwords, etc) 30->76 47 cmd.exe 1 35->47         started        file12 signatures13 process14 signatures15 102 Uses ipconfig to lookup or modify the Windows network settings 47->102 50 conhost.exe 47->50         started        52 ipconfig.exe 47->52         started        process16
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2/
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0304fe2f5cbac1cc2e79bdbc8daa3824d6a8eb139f4d5bec7b57358cd4de8252
TrickBot
0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb
TrickBot
14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
TrickBot
264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98
TrickBot
4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919
TrickBot
5787c6b7af7d648a2dd1caae5a73e9c92c38c061edb282d4189e51d5e2a79c49
TrickBot
61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e
TrickBot
6cdc36e5c8774b62bbeeaa2141af5fd3c9c5ca33e0197e6301f76f23e59e9e22
TrickBot
dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727
TrickBot
decd474e4c808ac1a3255e1b6aecab359028bbadb6852f9ff70b33fdea648978
TrickBot
+ 4'265 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:sof1 banker trojan
Link:
https://tria.ge/reports/211014-w3r7fsabc3/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
295979d0d4eae3debf6f78a7b971de28f0671d7efcac845da9bb97a342b11b7a
MD5 hash:
41b4d09c270421d2049ce0bb752ba1f3
SHA1 hash:
c26e42c3257db3c071f4b2ecf60c5e8865240afb
Link:
https://www.unpac.me/results/8c4e2573-1dce-4672-b694-c48c02023bec/
SH256 hash:
72c477c7ce3f96e9a6e5f3fe03045cee10c7eaaeead986afe686c224d09a4e5c
MD5 hash:
4e078636f76753ac6167653ac9e1b958
SHA1 hash:
8b5bca5b710024780de36b60b3431003f9f81325
Link:
https://www.unpac.me/results/8c4e2573-1dce-4672-b694-c48c02023bec/
SH256 hash:
8d88a5e9d338e6e3c84f5af97fa79889930ad4f2cbe12528347a2dc0c0b17bab
MD5 hash:
101d25118f0670f12d98d3b47aba9d44
SHA1 hash:
233b6b55a2492a0112a05072d728efde28c662cf
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8c4e2573-1dce-4672-b694-c48c02023bec/
Parent samples :
14da4c490e00343fde9db5a283c5b2f36d9699e5b5ef6df7f40ff51f97cbe8fe
9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2
be6f52a5ec95249cc20be5224a6c1e759e06a447c7996b98d063308d3077a2d0
8535cee5617eb72238f813ef3ae9884558c79cfdce04125e1adec30091e7a7b3
SH256 hash:
e2de4de3147a386f1e9b2d020438e1dcf42219c562541b81b5e056a8d616e9aa
MD5 hash:
b02f4cf6da8ae9f18d9a71f3e0291549
SHA1 hash:
18b8e4881b51ba8117b1760f02247a007a7f6669
Link:
https://www.unpac.me/results/8c4e2573-1dce-4672-b694-c48c02023bec/
SH256 hash:
9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2
MD5 hash:
463576e11c092968f3ee4f0686f7210d
SHA1 hash:
88f07c32077c812ef08827141eabcc15fc1d142a
Link:
https://www.unpac.me/results/8c4e2573-1dce-4672-b694-c48c02023bec/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9e470e0dec16/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll 9e470e0dec1667c6c05aed506db5d6bfbfc0ee313627531aaffccc3c0a72f8b2

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197616/

Comments


Avatar
zbet commented on 2021-10-14 18:27:05 UTC

url : hxxp://195.133.192.101/images/redplane.png