🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc
SHA3-384 hash: 3a0cf326f7b0dc1a880ba9eead37dee79212ef7f28d5d9998315f07bf4a5646bab0353298452216e3debbecde95974b0
SHA1 hash: f7255a24af4304d18986a9d019ddb85d5dd09bea
MD5 hash: 24fb3fd5b93f3b94032982fa355480bd
humanhash: jersey-leopard-lima-mockingbird
File name:sep2
Download: download sample
Signature TrickBot
Create hunting rule
File size:3'099'269 bytes
First seen:2021-06-28 19:32:30 UTC
Last seen:2021-06-28 20:39:46 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e877652137f9a4cc34a0b63661b3ba6a (8 x TrickBot)
ssdeep 49152:QvpSnKuvTx53YV/6BSjGElRroOcMKOKmMm7WHgKLES5fQCnNId1aDAgMckR84+wt:7ln3YcBSjFlRroOcXOhgXkR84VW4t
Threatray 2 similar samples on MalwareBazaar
TLSH D6E56D21F900903AF6EB00FBC3F7457DAD789B20135550D742C079EAAB66ED97932A27
Reporter Anonymous
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
201
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168621/
Detection(s):
SecuriteInfo.com.FileRepMalware.2746.21392.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/45ccd490-97c3-46eb-84e6-7995d40a7365
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/808997
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hijacks the control flow in another process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441408 Sample: sep2 Startdate: 28/06/2021 Architecture: WINDOWS Score: 84 65 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->65 67 Yara detected Trickbot 2->67 8 loaddll32.exe 1 2->8         started        process3 signatures4 73 Writes to foreign memory regions 8->73 75 Allocates memory in foreign processes 8->75 11 wermgr.exe 8->11         started        15 regsvr32.exe 8->15         started        17 cmd.exe 1 8->17         started        19 2 other processes 8->19 process5 dnsIp6 59 190.109.204.126, 443, 49766 METROREDSADECVHN Honduras 11->59 61 icanhazip.com 104.18.6.156, 49762, 80 CLOUDFLARENETUS United States 11->61 63 7 other IPs or domains 11->63 77 Hijacks the control flow in another process 11->77 79 Writes to foreign memory regions 11->79 81 Tries to detect virtualization through RDTSC time measurements 11->81 83 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 11->83 21 cmd.exe 11->21         started        26 cmd.exe 11->26         started        28 WerFault.exe 6 9 15->28         started        30 rundll32.exe 17->30         started        32 iexplore.exe 152 19->32         started        34 WerFault.exe 19->34         started        signatures7 process8 dnsIp9 49 12.23.113.92, 443, 49775 ATT-INTERNET4US United States 21->49 43 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 21->43 dropped 45 C:\Users\user\AppData\...\Login Data.bak, SQLite 21->45 dropped 47 C:\Users\user\AppData\Local\...\History.bak, SQLite 21->47 dropped 69 Tries to harvest and steal browser information (history, passwords, etc) 21->69 36 conhost.exe 21->36         started        38 conhost.exe 26->38         started        71 Tries to evade analysis by execution special instruction which cause usermode exception 28->71 40 WerFault.exe 19 9 30->40         started        51 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49749, 49750 YAHOO-DEBDE United Kingdom 32->51 53 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49743, 49744 FASTLYUS United States 32->53 55 10 other IPs or domains 32->55 file10 signatures11 process12 dnsIp13 57 192.168.2.1 unknown unknown 40->57
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-06-28 19:33:10 UTC
AV detection:
7 of 46 (15.22%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
32a8d650cdb03abcc979011c25a18411afc65a7e8012e8c1a6cb4125ba6d83aa
TrickBot
d9246658c652dfdbd5072768db4183dd4a032184b0c3c9adc014687ad60b13d2
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev2 banker trojan
Link:
https://tria.ge/reports/210628-6sa2hcet86/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
8b12fac443cb6221612525807526b4df40cd415fdc0bda05b9660289cb783b75
MD5 hash:
18bde373ea41ed03a97b41f08c0a8a93
SHA1 hash:
689f32b96df2dd1c0620fa9951ae3d76a4c6c62f
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f8e87b75-ad9a-48e9-befd-01d57d7ad81f/
SH256 hash:
59aecd39f595d0b0b2c48c8a73d8a74ead27dd333e02e01bd9befdfa160792c5
MD5 hash:
965313bd1a50416250d294bc2a0ae5a2
SHA1 hash:
85e973951b31b8cc159ecaa195f7385e778c7b29
Link:
https://www.unpac.me/results/f8e87b75-ad9a-48e9-befd-01d57d7ad81f/
SH256 hash:
afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc
MD5 hash:
24fb3fd5b93f3b94032982fa355480bd
SHA1 hash:
f7255a24af4304d18986a9d019ddb85d5dd09bea
Link:
https://www.unpac.me/results/f8e87b75-ad9a-48e9-befd-01d57d7ad81f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Word file docm d6d22450a3cb3552c14ad7af8deb1df1b2d94aea2761cf5107b18a4e4c43882a

TrickBot

DLL dll afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc

(this sample)

  
Dropped by
SHA256 d6d22450a3cb3552c14ad7af8deb1df1b2d94aea2761cf5107b18a4e4c43882a
Cape
Cape
https://www.capesandbox.com/analysis/168621/

Comments