🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28
SHA3-384 hash: 2464ce59faf277e493cc7068190458b496d67c42ed5d490b74947691ccfeab8632dc49120bd647b30d9399f5209dd41d
SHA1 hash: 1785eb7db3c1465d7a6de748b7d8ae4460d80e1f
MD5 hash: 66f5c4c0484834b5252c4fd3f8ee4516
humanhash: quebec-grey-yellow-sixteen
File name:repoRequestDocument.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:3'099'782 bytes
First seen:2021-06-29 02:19:55 UTC
Last seen:2021-06-29 03:22:38 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash e877652137f9a4cc34a0b63661b3ba6a (8 x TrickBot)
ssdeep 49152:bX85+GzBYx5ulXJyA889lRN2G6tEw1um7WHgKLES5fQC4NIINE67Qg3ErgbJwaTr:/ISulgA889lRN2G6mwggUrgbJyaBv
Threatray 4 similar samples on MalwareBazaar
TLSH 72E56D21E900903AF6EB00FBC3F7457DAD789B20131560D742C479EAEB66DD97932A27
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/168652/
Detection(s):
SecuriteInfo.com.VHO.Trojan-Banker.Win32.Trickster.gen.7067.25278.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/21a68ebd-9223-47fa-855e-171f7f2dd3e6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/809084
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Initial sample is a PE file and has a suspicious name
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction which cause usermode exception
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 441491 Sample: repoRequestDocument.jpg Startdate: 29/06/2021 Architecture: WINDOWS Score: 80 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 Initial sample is a PE file and has a suspicious name 2->53 8 loaddll32.exe 1 2->8         started        process3 signatures4 57 Writes to foreign memory regions 8->57 59 Allocates memory in foreign processes 8->59 11 wermgr.exe 8->11         started        15 regsvr32.exe 8->15         started        17 iexplore.exe 2 71 8->17         started        19 2 other processes 8->19 process5 dnsIp6 43 190.109.204.126, 443, 49753 METROREDSADECVHN Honduras 11->43 45 icanhazip.com 104.18.7.156, 49742, 80 CLOUDFLARENETUS United States 11->45 47 7 other IPs or domains 11->47 61 Writes to foreign memory regions 11->61 63 Tries to detect virtualization through RDTSC time measurements 11->63 65 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 11->65 21 cmd.exe 11->21         started        23 WerFault.exe 23 9 15->23         started        26 iexplore.exe 152 17->26         started        29 rundll32.exe 19->29         started        31 WerFault.exe 19->31         started        signatures7 process8 dnsIp9 33 conhost.exe 21->33         started        55 Tries to evade analysis by execution special instruction which cause usermode exception 23->55 37 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49728, 49729 FASTLYUS United States 26->37 39 geolocation.onetrust.com 104.20.184.68, 443, 49714, 49715 CLOUDFLARENETUS United States 26->39 41 8 other IPs or domains 26->41 35 WerFault.exe 19 9 29->35         started        signatures10 process11
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-06-29 00:48:22 UTC
AV detection:
7 of 29 (24.14%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
TrickBot
32a8d650cdb03abcc979011c25a18411afc65a7e8012e8c1a6cb4125ba6d83aa
TrickBot
afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc
TrickBot
d9246658c652dfdbd5072768db4183dd4a032184b0c3c9adc014687ad60b13d2
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev1 banker trojan
Link:
https://tria.ge/reports/210629-5jg79qf4ye/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
d74438ba6ce59d50531b9e5396b9ac911dfd1a5c02d84698940836c16d30f615
MD5 hash:
0d9285e6e7e1adf77a48b8c72b21cf27
SHA1 hash:
ef26edf4573c161e2e0d84136f2a03790acbbef0
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/2dfb57c8-f7f6-4786-b497-58c70fe67067/
Parent samples :
8368a955dd5d9850ed8ced6144a202368c52e065abafdb71a7960d3a90647e85
9822e135cafc24d7d610a2831cd97e13c0f2b3ce1935aadde0bbbcf140395bba
b827fde51c75a1c5a400dd99d5b345f946874d77587384d31e3ca188364e92a4
c601014207780cd2448d3953272a43cacc9252bc86b365b7869af2a6a2ab3c09
b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28
97c1deed13a9dba0c5834c3961ec93f96897e45e56f1c86a641427228830fcd4
0bb797aef9711d46a54f363b0d28211337605db7d84b079e91cae672f7a981d4
SH256 hash:
84a2daa18ecfa084df7889d6f25aa5b775c46c14203fe94962f2479031019c08
MD5 hash:
b77e64162a21fd6ba5c027923a0acbdc
SHA1 hash:
11da5592527274d1353c1d6361a4f3b04e771af9
Link:
https://www.unpac.me/results/2dfb57c8-f7f6-4786-b497-58c70fe67067/
SH256 hash:
b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28
MD5 hash:
66f5c4c0484834b5252c4fd3f8ee4516
SHA1 hash:
1785eb7db3c1465d7a6de748b7d8ae4460d80e1f
Link:
https://www.unpac.me/results/2dfb57c8-f7f6-4786-b497-58c70fe67067/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3c17ea77c22b4f4ce232f4de674e1ab8639d063f54cc088612f73d7a7268a28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/168652/

Comments