🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff
SHA3-384 hash: 514f05ef52c260eef21379ba24e7544dd557e6152e6f1cd80c65b9ce28a3a1121121cc918555be82456ece159437a89e
SHA1 hash: 2106614ad15b92e86549d40916daa17f80b77045
MD5 hash: 4c5ea6cabf86165549935d316d1f6388
humanhash: violet-nuts-emma-table
File name:4c5ea6cabf86165549935d316d1f6388.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:487'551 bytes
First seen:2021-10-06 08:20:30 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f34a0f23e05f2c2a829565c932b87430 (15 x TrickBot)
ssdeep 12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Kll4:bEKNb/aZl6KdSrs+4
Threatray 4'041 similar samples on MalwareBazaar
TLSH T14DA4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
240
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195355/
Detection(s):
SecuriteInfo.com.Artemis45BD1517B770.186.19982.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/615d5c71e3d213d202b8495c/reports/426f8e40-3556-488e-bd21-6ceee0c58c2d/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5f16d7b-2191-4de8-b796-54f314251b72
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/865339
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for dropped file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 497765 Sample: f5rSnwtlOS.dll Startdate: 06/10/2021 Architecture: WINDOWS Score: 100 61 Found malware configuration 2->61 63 Multi AV Scanner detection for dropped file 2->63 65 Yara detected Trickbot 2->65 67 Sigma detected: Regsvr32 Command Line Without DLL 2->67 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        process3 signatures4 69 Writes to foreign memory regions 8->69 71 Allocates memory in foreign processes 8->71 13 regsvr32.exe 8->13         started        16 cmd.exe 1 8->16         started        18 rundll32.exe 8->18         started        20 2 other processes 8->20 process5 dnsIp6 83 Writes to foreign memory regions 13->83 85 Allocates memory in foreign processes 13->85 87 Queues an APC in another process (thread injection) 13->87 23 wermgr.exe 2 13->23         started        89 Early bird code injection technique detected 16->89 27 rundll32.exe 16->27         started        29 wermgr.exe 18->29         started        41 202.9.121.143, 443, 49794, 49805 WORLD-ASWorldStarCommunicationIN India 20->41 43 ipecho.net 34.117.59.81, 49813, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 20->43 45 4 other IPs or domains 20->45 32 iexplore.exe 7 145 20->32         started        signatures7 process8 dnsIp9 47 103.146.232.154, 443, 49733, 49767 WIDENET-AS-INWideNetcomIndiaIN unknown 23->47 49 wtfismyip.com 54.39.106.25, 49801, 49802, 80 OVHFR Canada 23->49 55 3 other IPs or domains 23->55 73 Tries to detect virtualization through RDTSC time measurements 23->73 75 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 23->75 77 Writes to foreign memory regions 27->77 79 Allocates memory in foreign processes 27->79 81 Delayed program exit found 27->81 34 wermgr.exe 27->34         started        51 103.123.86.104, 443, 49734, 49770 PROMPTIC-ASPromptInfracomPrivateLimitedIN India 29->51 57 3 other IPs or domains 29->57 37 C:\Users\user\AppData\...\jtf5rSnwtlOSzj.trd, PE32 29->37 dropped 53 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49797, 49798 YAHOO-DEBDE United Kingdom 32->53 59 26 other IPs or domains 32->59 file10 signatures11 process12 dnsIp13 39 36.91.117.231, 443, 49732, 49976 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID Indonesia 34->39
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-06 08:21:07 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjr6aofpgb4rryl2wbyotvxbeugxwxduk65rbhd5wwpmthvnrp7q._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0e3d9ce252ddfed3baf8dd48a895a2e6b718021abd242626ade783e423c4d96c
TrickBot
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
TrickBot
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
TrickBot
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
TrickBot
7648c2583b2f2e47a49f3ca435189ad0b21ec43efade37d98333917285732474
TrickBot
89932cba5b5d516255703ec625731f812e8939f6c6d64af82019ce3050280a29
TrickBot
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
TrickBot
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
TrickBot
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
TrickBot
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
TrickBot
+ 4'031 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zvs1 banker trojan
Link:
https://tria.ge/reports/211006-j81pkabafm/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
2aadcd168cc1e1cc465b57548f32f26f3d45fefe61e072563915ddf826a5b32d
MD5 hash:
165222903380731b1cf87db722b54aa5
SHA1 hash:
cad66a3edd3b3eafa9d9816c40e033f99ef18ed6
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/8fbca4e9-eb67-44b8-9c5e-43a1d2b84c2e/
Parent samples :
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
57db3ac25a078af4897c0e0074529675c5deae55088709e692c2f1e6beb54cf7
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
7648c2583b2f2e47a49f3ca435189ad0b21ec43efade37d98333917285732474
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
90affcc89243f2e6f5eed9f89ec42079459510e329abb132a4749fe0817af1eb
0e3d9ce252ddfed3baf8dd48a895a2e6b718021abd242626ade783e423c4d96c
a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff
89932cba5b5d516255703ec625731f812e8939f6c6d64af82019ce3050280a29
e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8
SH256 hash:
6306bbdc63e0ec3720047f5a6e28c67890ad1c8765ceec85cde5889162293b22
MD5 hash:
3409f865936a247957955ad2df45a2cd
SHA1 hash:
be7e5017d762bc10278ddd0c6b7752c50c014ae0
Link:
https://www.unpac.me/results/8fbca4e9-eb67-44b8-9c5e-43a1d2b84c2e/
SH256 hash:
3dc39f72fc1dd38da7277ffed474b5a3252809038ee23fe60f4232b5f7c7dff2
MD5 hash:
b67694dddf98298b539bddc8cabc255d
SHA1 hash:
7cfdc9b871972066055bdbe586dc8b394b6c0499
Link:
https://www.unpac.me/results/8fbca4e9-eb67-44b8-9c5e-43a1d2b84c2e/
SH256 hash:
6515084c99478975c73987727e813ea6e8fa8046f425c8e88b54f6eeeea225d8
MD5 hash:
34d6a6bffa656c6b0c7b588e111dbed1
SHA1 hash:
06aea3fd95b58a9a93f7fc2a721c715be6c3b7b1
Link:
https://www.unpac.me/results/8fbca4e9-eb67-44b8-9c5e-43a1d2b84c2e/
SH256 hash:
aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff
MD5 hash:
4c5ea6cabf86165549935d316d1f6388
SHA1 hash:
2106614ad15b92e86549d40916daa17f80b77045
Link:
https://www.unpac.me/results/8fbca4e9-eb67-44b8-9c5e-43a1d2b84c2e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/aa63e038af30/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1656271/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195355/

Comments