🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d
SHA3-384 hash: 500e4bfe881c32da4081d466718149ea5a95f50f7a133406e418f178ac3445fb66b5286cc539f274490cabea6945c925
SHA1 hash: 973f4f28d656949862e0fc0e0e0f371858aa1da7
MD5 hash: a025bf940882b77993185b7b9abe73ab
humanhash: glucose-aspen-delaware-skylark
File name:triage_dropped_file
Download: download sample
Signature TrickBot
Create hunting rule
File size:390'744 bytes
First seen:2021-10-12 19:21:32 UTC
Last seen:2021-10-12 20:12:24 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dab55116faaa0071397d3d6dcc79a12c (1 x TrickBot)
ssdeep 6144:d6w6ZtlHId99S/FEPVb91cpIp0jTLg6+grUesV3LPmCUbLNpjz:d6r5IdutEPFf6VjHgaq3TgXz
Threatray 2 similar samples on MalwareBazaar
TLSH T16784E1117255C072D2A624394E2693724B6AB8B1DFB199CB7FE44ABE4F793C1CE34306
File icon (PE):PE icon
dhash icon 3a36f0a86e908ac0 (5 x TrickBot)
Reporter malwarelabnet
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
439
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197025/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.110.29314.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/6165e05dfd35fe780c3b5301/reports/7e900f25-caec-4654-b65f-02482bf247b2/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/72d90a81-bbf4-4892-b9f9-91c46f150caa
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/869002
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Machine Learning detection for sample
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 501426 Sample: triage_dropped_file Startdate: 12/10/2021 Architecture: WINDOWS Score: 100 63 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->63 65 Found malware configuration 2->65 67 Yara detected Trickbot 2->67 69 3 other signatures 2->69 7 loaddll32.exe 1 2->7         started        process3 signatures4 73 Writes to foreign memory regions 7->73 75 Allocates memory in foreign processes 7->75 10 wermgr.exe 7->10         started        14 iexplore.exe 1 73 7->14         started        16 rundll32.exe 7->16         started        18 4 other processes 7->18 process5 dnsIp6 57 103.248.217.234, 443, 49915, 50067 IDNIC-NORLECTELEKOMINDO-AS-IDPTNorlecTelekomunikasiIndon Indonesia 10->57 59 202.65.119.162, 443, 49892, 49895 CITRA-AS-IDPTJEMBATANCITRANUSANTARAID Indonesia 10->59 61 4 other IPs or domains 10->61 77 Hijacks the control flow in another process 10->77 79 Writes to foreign memory regions 10->79 81 Tries to detect virtualization through RDTSC time measurements 10->81 83 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 10->83 20 svchost.exe 10->20         started        25 svchost.exe 10->25         started        27 svchost.exe 10->27         started        29 iexplore.exe 2 151 14->29         started        31 WerFault.exe 16->31         started        33 WerFault.exe 16->33         started        35 rundll32.exe 18->35         started        signatures7 process8 dnsIp9 45 109.87.143.67, 443, 50077, 50088 TRIOLANUA Ukraine 20->45 47 178.151.205.154, 443, 50071, 50082 TRIOLANUA Ukraine 20->47 53 9 other IPs or domains 20->53 37 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 20->37 dropped 39 C:\Users\user\AppData\...\Login Data.bak, SQLite 20->39 dropped 41 C:\Users\user\AppData\Local\...\History.bak, SQLite 20->41 dropped 43 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 20->43 dropped 71 Tries to harvest and steal browser information (history, passwords, etc) 20->71 49 pixel-origin.mathtag.com 185.29.132.245, 443, 49847, 49848 MEDIAMATH-INCUS United Kingdom 29->49 51 cm.g.doubleclick.net 172.217.168.34, 443, 49841, 49842 GOOGLEUS United States 29->51 55 25 other IPs or domains 29->55 file10 signatures11
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d/
Threat name:
Win32.Trojan.AgentAGen
Create hunting rule
Status:
Malicious
First seen:
2021-10-12 19:25:13 UTC
AV detection:
6 of 28 (21.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
36f76be816898a8ac90603edeed2ff90983d062f047f6e00c66d54964c582cc8
TrickBot
da84453f047b0c5e2a88e6ba46a11f390b4944f7c7f45563e19aef895c196e8e
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev4 banker trojan
Link:
https://tria.ge/reports/211012-x2891sdbe7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d
MD5 hash:
a025bf940882b77993185b7b9abe73ab
SHA1 hash:
973f4f28d656949862e0fc0e0e0f371858aa1da7
Link:
https://www.unpac.me/results/db881a04-a526-4840-a841-48740ee18ff3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b9879d2af3db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b9879d2af3dbcd380c1895d78f26e41782fd2c08c324d459a86476bfdb762f4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/197025/

Comments