🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
SHA3-384 hash: 8aad9bc37ee9fec6c4e4c9d347d48b539fab851aa972a66f22e6e450ecce0d381d0d128ce95b3374f076503f4082310c
SHA1 hash: 316f7c2646ba8837a7b356bb00bddc85693e78aa
MD5 hash: 070d44df8e4e787599fc5834434fe522
humanhash: salami-arkansas-arkansas-michigan
File name:070d44df8e4e787599fc5834434fe522.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:487'551 bytes
First seen:2021-10-06 08:20:12 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f34a0f23e05f2c2a829565c932b87430 (15 x TrickBot)
ssdeep 12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Kllc:bEKNb/aZl6KdSrs+c
Threatray 3'901 similar samples on MalwareBazaar
TLSH T1B9A4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
237
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195354/
Detection(s):
SecuriteInfo.com.Artemis45BD1517B770.186.19982.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/615d5c70b95458900cdd0082/reports/6eef4e01-75f1-4749-903b-9458209e5cd1/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fde09e81-7854-4567-baac-7b975c2e8c41
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/865340
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 497766 Sample: N8OeefFV0T.dll Startdate: 06/10/2021 Architecture: WINDOWS Score: 100 63 Found malware configuration 2->63 65 Multi AV Scanner detection for dropped file 2->65 67 Multi AV Scanner detection for submitted file 2->67 69 2 other signatures 2->69 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 rundll32.exe 2->13         started        process3 signatures4 71 Writes to foreign memory regions 8->71 73 Allocates memory in foreign processes 8->73 15 regsvr32.exe 8->15         started        18 cmd.exe 1 8->18         started        20 rundll32.exe 8->20         started        22 2 other processes 8->22 process5 signatures6 85 Writes to foreign memory regions 15->85 87 Allocates memory in foreign processes 15->87 89 Queues an APC in another process (thread injection) 15->89 24 wermgr.exe 15->24         started        91 Early bird code injection technique detected 18->91 28 rundll32.exe 18->28         started        30 wermgr.exe 20->30         started        33 iexplore.exe 2 161 22->33         started        process7 dnsIp8 49 36.91.117.231, 443, 49832, 49847 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID Indonesia 24->49 75 Tries to detect virtualization through RDTSC time measurements 24->75 77 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 24->77 79 Writes to foreign memory regions 28->79 81 Allocates memory in foreign processes 28->81 83 Delayed program exit found 28->83 35 wermgr.exe 3 28->35         started        51 45.115.172.105, 443, 49838, 49855 MNET-ASMukandInfotelPvtLtdIN India 30->51 53 ipinfo.io 30->53 59 3 other IPs or domains 30->59 41 C:\Users\user\AppData\...\pdN8OeefFV0Tnb.trd, PE32 30->41 dropped 55 cm.g.doubleclick.net 142.250.203.98, 443, 49791, 49792 GOOGLEUS United States 33->55 57 dart.l.doubleclick.net 172.217.168.38, 443, 49826, 49827 GOOGLEUS United States 33->57 61 25 other IPs or domains 33->61 file9 signatures10 process11 dnsIp12 43 139.255.65.170, 443, 49835, 49848 LINKNET-ID-APLinknetASNID Indonesia 35->43 45 ipinfo.io 34.117.59.81, 49860, 49861, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 35->45 47 4 other IPs or domains 35->47 39 C:\Users\user\AppData\...\rnN8OeefFV0Tnd.trd, PE32 35->39 dropped file13
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 22:38:43 UTC
AV detection:
16 of 45 (35.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uwagt5bv5syg4gndktrvvelav4vwf76xd77bbgoqdnhfm5qkf4eq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0e3d9ce252ddfed3baf8dd48a895a2e6b718021abd242626ade783e423c4d96c
TrickBot
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
TrickBot
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
TrickBot
7648c2583b2f2e47a49f3ca435189ad0b21ec43efade37d98333917285732474
TrickBot
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
TrickBot
90affcc89243f2e6f5eed9f89ec42079459510e329abb132a4749fe0817af1eb
TrickBot
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
TrickBot
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
TrickBot
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
TrickBot
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
TrickBot
+ 3'891 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zvs1 banker trojan
Link:
https://tria.ge/reports/211006-j81pkaagg2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
2aadcd168cc1e1cc465b57548f32f26f3d45fefe61e072563915ddf826a5b32d
MD5 hash:
165222903380731b1cf87db722b54aa5
SHA1 hash:
cad66a3edd3b3eafa9d9816c40e033f99ef18ed6
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/174ed7ae-c9e0-4b90-959e-571ca3b60540/
Parent samples :
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
57db3ac25a078af4897c0e0074529675c5deae55088709e692c2f1e6beb54cf7
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
7648c2583b2f2e47a49f3ca435189ad0b21ec43efade37d98333917285732474
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
90affcc89243f2e6f5eed9f89ec42079459510e329abb132a4749fe0817af1eb
0e3d9ce252ddfed3baf8dd48a895a2e6b718021abd242626ade783e423c4d96c
a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff
89932cba5b5d516255703ec625731f812e8939f6c6d64af82019ce3050280a29
e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8
SH256 hash:
6306bbdc63e0ec3720047f5a6e28c67890ad1c8765ceec85cde5889162293b22
MD5 hash:
3409f865936a247957955ad2df45a2cd
SHA1 hash:
be7e5017d762bc10278ddd0c6b7752c50c014ae0
Link:
https://www.unpac.me/results/174ed7ae-c9e0-4b90-959e-571ca3b60540/
SH256 hash:
3dc39f72fc1dd38da7277ffed474b5a3252809038ee23fe60f4232b5f7c7dff2
MD5 hash:
b67694dddf98298b539bddc8cabc255d
SHA1 hash:
7cfdc9b871972066055bdbe586dc8b394b6c0499
Link:
https://www.unpac.me/results/174ed7ae-c9e0-4b90-959e-571ca3b60540/
SH256 hash:
6515084c99478975c73987727e813ea6e8fa8046f425c8e88b54f6eeeea225d8
MD5 hash:
34d6a6bffa656c6b0c7b588e111dbed1
SHA1 hash:
06aea3fd95b58a9a93f7fc2a721c715be6c3b7b1
Link:
https://www.unpac.me/results/174ed7ae-c9e0-4b90-959e-571ca3b60540/
SH256 hash:
a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
MD5 hash:
070d44df8e4e787599fc5834434fe522
SHA1 hash:
316f7c2646ba8837a7b356bb00bddc85693e78aa
Link:
https://www.unpac.me/results/174ed7ae-c9e0-4b90-959e-571ca3b60540/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/a58069f435ec/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1656268/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195354/

Comments