MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3e4dfcdaf5a15bc2ccabfb4ee3e65c1c14a5d66f8becf23a4ed6a79089a81f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3e4dfcdaf5a15bc2ccabfb4ee3e65c1c14a5d66f8becf23a4ed6a79089a81f9
SHA3-384 hash: 63881ce87a035c9e90ad6dfacc7022f661df07cc03ddf2c8799a9a9d3fb99695f55a03c5d478336465dac5ae2cdc226b
SHA1 hash: bf37c983936ec5690bda0e62ff3819904d11041e
MD5 hash: 5e3ac60f9af6bd3b89111fc54fb64293
humanhash: bluebird-network-bravo-pizza
File name:grtf.ccddf
Download: download sample
Signature TrickBot
Create hunting rule
File size:570'880 bytes
First seen:2021-03-01 13:42:33 UTC
Last seen:2021-03-01 18:30:23 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 29b9e3fafaf588ee9941e6fa18b13651 (1 x TrickBot)
ssdeep 12288:+KqoNFWaCEMTnoy/Zs8IyVIzsRBrcMTvrRRYHy6qunhKEKD92UCd:+KqoNFWaCEMTRZs8pECTzRRYymyD1C
Threatray 12 similar samples on MalwareBazaar
TLSH 5AC4D031F9444415C6FE0A3728B6FFC3D53DB29D9F105A93B66C06AD8BA04A1A359BC3
Reporter ffforward
Tags:dll rob20 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/120305/
Detection(s):
SecuriteInfo.com.ML.PE-A.4900.15886.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/622206
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 360109 Sample: grtf.ccddf Startdate: 01/03/2021 Architecture: WINDOWS Score: 96 42 83.220.115.230 TMPL Poland 2->42 44 177.84.63.252 PlisInteligenciaemTecnologiaLtdaBR Brazil 2->44 46 2 other IPs or domains 2->46 60 Found malware configuration 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 Yara detected Trickbot 2->64 66 C2 URLs / IPs found in malware configuration 2->66 10 loaddll32.exe 1 2->10         started        12 rundll32.exe 2->12         started        signatures3 process4 process5 14 rundll32.exe 10->14         started        17 cmd.exe 1 10->17         started        19 regsvr32.exe 10->19         started        signatures6 78 Writes to foreign memory regions 14->78 80 Allocates memory in foreign processes 14->80 82 Delayed program exit found 14->82 21 wermgr.exe 14->21         started        25 iexplore.exe 1 74 17->25         started        process7 dnsIp8 48 187.190.116.59, 443, 49744, 49750 TOTALPLAYTELECOMUNICACIONESSADECVMX Mexico 21->48 50 103.155.239.1, 447, 49751 TWIDC-AS-APTWIDCLimitedHK unknown 21->50 52 4 other IPs or domains 21->52 68 Hijacks the control flow in another process 21->68 70 Writes to foreign memory regions 21->70 72 Tries to detect virtualization through RDTSC time measurements 21->72 74 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 21->74 27 cmd.exe 5 21->27         started        31 iexplore.exe 150 25->31         started        signatures9 process10 dnsIp11 36 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 27->36 dropped 38 C:\Users\user\AppData\...\Login Data.bak, SQLite 27->38 dropped 40 C:\Users\user\AppData\Local\...\History.bak, SQLite 27->40 dropped 76 Tries to harvest and steal browser information (history, passwords, etc) 27->76 34 conhost.exe 27->34         started        54 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49741, 49742 FASTLYUS United States 31->54 56 geolocation.onetrust.com 104.20.185.68, 443, 49727, 49728 CLOUDFLARENETUS United States 31->56 58 8 other IPs or domains 31->58 file12 signatures13 process14
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b3e4dfcdaf5a15bc2ccabfb4ee3e65c1c14a5d66f8becf23a4ed6a79089a81f9/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-01 13:43:20 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpsn7tnplik3ylgkx62o4ptfyhauuxlg7c7m6i5e5vvhsce2qh4q._file
Verdict:
unknown
Similar samples:
2a11f8f83b6c7fc23742f76d10d013aef543026557ddcd62879a638f6fd00c52
TrickBot
4b70ed83db2eef5aedb7a0185ecc17345c32bb0d8c218716c71d73425d32fd03
TrickBot
5d23faa05258eb51b196fee00263dc5e4556a37301d312563843a7ac8494ee19
TrickBot
7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6
TrickBot
8f71441f8e9db24dceee698de265dab77bda6298ceb4b9bc8cb1d77a54d7229d
TrickBot
9727c687448fb19944524631d76df2facf3fdb70324e2c61d535756fcd838ddb
TrickBot
a9da529f0ad9088cec7e9441a7081084f417655533998caa004597a1bc6ef262
TrickBot
d34f87c6a070f4f73344156c16be7040f2932053aea2868e98b0fa4297113835
TrickBot
ef5668ef9d4d57dde144de48458f5b007c8045798aebbeec51274ff0287655d3
TrickBot
f8cd5468cae1b7ef288867c7be839e906c6671310d07c8811d044e435b2759e0
TrickBot
+ 2 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob20 banker trojan
Link:
https://tria.ge/reports/210301-66lt9xnajs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
154.79.252.132:449
179.191.108.58:449
200.6.169.124:443
103.76.20.226:443
80.78.77.116:449
80.78.75.246:443
45.234.248.66:449
187.190.116.59:443
185.234.72.84:443
36.94.202.131:443
103.91.244.102:449
168.232.188.88:449
103.73.101.98:449
173.81.4.147:449
202.142.151.190:449
118.67.216.238:449
108.170.20.72:443
85.159.214.61:443
36.92.93.5:449
79.122.166.236:449
201.184.190.59:449
111.235.66.83:443
187.19.200.154:449
186.195.199.238:449
103.84.164.87:443
117.212.193.62:449
190.152.71.230:443
37.235.230.123:449
103.119.117.42:443
177.47.88.62:443
103.146.2.152:449
102.164.211.138:449
182.48.66.106:443
178.54.230.164:443
221.176.88.201:449
167.179.194.205:443
179.60.243.52:443
Unpacked files
SH256 hash:
482e7d0334dd6dce7c743adab0883c68fa9d2fe0c7eaaede2822a08de8098d82
MD5 hash:
d6ca8fbdcdd913ca7ca1dedd727d3f74
SHA1 hash:
e537110b507f78530db31683ed818c2719afbd17
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/593adb40-2f6e-4e36-833a-dea54fde98d0/
SH256 hash:
b12c7ccb381849436c381175a97abbf4e8a4a8b7bb0eae8dd101eda2ac3e8520
MD5 hash:
52cb5a491c4a2b333941e3b6d11ded29
SHA1 hash:
6c0bc39ef9b7276f7b27d563ac7dc973583c39b0
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/593adb40-2f6e-4e36-833a-dea54fde98d0/
SH256 hash:
b3e4dfcdaf5a15bc2ccabfb4ee3e65c1c14a5d66f8becf23a4ed6a79089a81f9
MD5 hash:
5e3ac60f9af6bd3b89111fc54fb64293
SHA1 hash:
bf37c983936ec5690bda0e62ff3819904d11041e
Link:
https://www.unpac.me/results/593adb40-2f6e-4e36-833a-dea54fde98d0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3e4dfcdaf5a15bc2ccabfb4ee3e65c1c14a5d66f8becf23a4ed6a79089a81f9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

TrickBot

Excel file xls 0c816905e4c5e91e2a5aaee5d2ffdfc49c63b07b8c2af8d249e83d0d8f3bbc0d

TrickBot

DLL dll b3e4dfcdaf5a15bc2ccabfb4ee3e65c1c14a5d66f8becf23a4ed6a79089a81f9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1040064/
  
Dropped by
SHA256 0c816905e4c5e91e2a5aaee5d2ffdfc49c63b07b8c2af8d249e83d0d8f3bbc0d
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/120305/
  
URLhaus
https://urlhaus.abuse.ch/url/1040816/

Comments