MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1
SHA3-384 hash: 97a6e60d6f3b878cdaddbaec0eb62b845ffd66769e4b7cd65b851db6e4e2f59537f4617dbf11f2a412c0d0bab4a076ee
SHA1 hash: 1095f8922d93458efbc97612d8a5dea8db8325a5
MD5 hash: 7df0611cd75fa4c02b29070728c37247
humanhash: winner-kentucky-nitrogen-skylark
File name:countryyelow.bin
Download: download sample
Signature TrickBot
Create hunting rule
File size:688'241 bytes
First seen:2021-04-06 15:26:46 UTC
Last seen:2021-04-06 16:18:05 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 2a7c1d4e219ead32f5cb5e583004dd0b (1 x TrickBot)
ssdeep 12288:9SeIHklNAPLJNfQPJt7TQJK7FvEVxw0xxteW:AklUjfQHDezxxtx
Threatray 269 similar samples on MalwareBazaar
TLSH 4EE4C00232D0C4F7F2AF06702DDBBFB9A3F8ED500A6ADD4397C4565E6E719828925315
Reporter j_dubp
Tags:TrickBot


Avatar
j_dubp
[0-9]{4,5}\.xls attachment downloads loader from revolet-sa[.]com/files #opendir

Intelligence

File Origin
# of uploads :
3
# of downloads :
316
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132688/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.23458.30490.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/667757
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses Windows timers to delay execution
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 382812 Sample: countryyelow.dll Startdate: 06/04/2021 Architecture: WINDOWS Score: 92 27 85.112.74.178 TERRANET-ASLB Lebanon 2->27 29 87.76.1.81 TELECOMRUNETRU Russian Federation 2->29 31 9 other IPs or domains 2->31 45 Found malware configuration 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 Yara detected Trickbot 2->49 51 C2 URLs / IPs found in malware configuration 2->51 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 25 9->11         started        14 cmd.exe 1 9->14         started        16 rundll32.exe 16 9->16         started        signatures6 53 Writes to foreign memory regions 11->53 55 Allocates memory in foreign processes 11->55 57 Uses Windows timers to delay execution 11->57 18 wermgr.exe 11->18         started        21 rundll32.exe 16 14->21         started        23 wermgr.exe 16->23         started        process7 signatures8 33 Found potential dummy code loops (likely to delay analysis) 18->33 35 Tries to detect virtualization through RDTSC time measurements 18->35 37 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 18->37 39 Writes to foreign memory regions 21->39 41 Allocates memory in foreign processes 21->41 43 Uses Windows timers to delay execution 21->43 25 wermgr.exe 21->25         started        process9
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-04-06 15:27:05 UTC
AV detection:
11 of 29 (37.93%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vql6d5klt6aa3b2oduas4va7ya332grr5y7i6yy2ivhs2hpgvwqq._file
Verdict:
malicious
Similar samples:
039f59cce1b9477f5de1d4297a72dcf2846e06885e39503191101fc14b0e20b1
TrickBot
330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52
TrickBot
4de9b39f13dec273fce9df377dda58fb8b9a9574824fbf9c47d3cf2de35a0ae1
TrickBot
57923313973c7955afed23ce377688c7eb1cc088423f0678206b3fb16bd433ec
TrickBot
75ef968283165b8a4fc163a383e2b28a210544fc10c05c914141f36c747ed23e
TrickBot
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3
TrickBot
8c206ff3cf89ee0ddf05f2608ef0535b7a2c17710e6ccec34ec6439d417dab69
TrickBot
8f98d0e1c30fd1a365380df0aef7e89cd29ba92dc26bd1da389987616470862c
TrickBot
9034c39e0f3006820fe581cc8ab796af0305370201761ff76d6816be1d3e4eb6
TrickBot
a3ce7f37c2bc3a65a5c2ed9e7e6da2369e8e54aa1cfd02c31ef54f9d7e938915
TrickBot
+ 259 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob44 banker trojan
Link:
https://tria.ge/reports/210406-n6yn8myzna/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
89.250.208.42:449
182.253.184.130:449
31.211.85.110:443
85.112.74.178:449
102.68.17.97:443
103.76.150.14:443
96.9.77.142:443
91.185.236.170:449
87.76.1.81:449
91.225.231.120:443
62.213.14.166:443
81.95.45.234:449
148.216.32.55:443
109.185.139.90:449
202.166.211.197:443
196.41.57.46:449
84.21.206.164:449
190.122.168.219:443
77.95.93.132:449
41.77.134.250:443
87.116.151.237:449
185.205.250.162:443
103.9.188.23:449
78.138.187.231:443
138.185.72.142:443
173.81.4.147:443
31.134.124.90:443
200.90.11.177:449
5.59.205.32:443
Unpacked files
SH256 hash:
652a208774fd49b7d9139e1356f3d7d95007ee3fa871281062a17c2c7ec3bf88
MD5 hash:
444ba6a64143b5f91d8839772aea5ebd
SHA1 hash:
a95b744b5977459594289589bb16063ca2ab5285
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/9ce9d01e-68f1-42c5-8f59-37f789d88c24/
SH256 hash:
b99bd272a3dd53b3638159fcfe1fd5df50cd80fede0edb066851ac31a9ce2470
MD5 hash:
5a519b734f7193208847cc511d752ea7
SHA1 hash:
a672133e1353a2d0ac10fd70f72977c1fa5e32be
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/9ce9d01e-68f1-42c5-8f59-37f789d88c24/
SH256 hash:
4f1532f0029db4fdf9c6b80067792ffb6a5a654726b64c6b2b6d428d050d96b4
MD5 hash:
e8c4a81698e223d25ac5f0cac5aa14f7
SHA1 hash:
302c12b351fe141709e25a24997adb5f75127c33
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/9ce9d01e-68f1-42c5-8f59-37f789d88c24/
SH256 hash:
ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1
MD5 hash:
7df0611cd75fa4c02b29070728c37247
SHA1 hash:
1095f8922d93458efbc97612d8a5dea8db8325a5
Link:
https://www.unpac.me/results/9ce9d01e-68f1-42c5-8f59-37f789d88c24/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1

(this sample)

anyrun
any.run
https://app.any.run/tasks/8cb5fbf5-7d07-4b28-aea0-1b87aec80df1
Cape
Cape
https://www.capesandbox.com/analysis/132688/
  
URLhaus
https://urlhaus.abuse.ch/url/1103154/
  
Delivery method
Distributed via web download

Comments