🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2e5d2f0c63677e5391c6faea8eb8b0da15fcad2b626ea09ae2bafe0144bc2e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2e5d2f0c63677e5391c6faea8eb8b0da15fcad2b626ea09ae2bafe0144bc2e5
SHA3-384 hash: beb20077ab4f80772abd48557ec214d56aa00f11190560ffb6548b02f97aa2b482402866e6c98d30170a5e4ebfe24182
SHA1 hash: a499b437b9c9ade56e47749ee09effa96b88eaf7
MD5 hash: 9f565a7a08363ccf1a6403e4bc232909
humanhash: island-carolina-muppet-potato
File name:triage_dropped_file
Download: download sample
Signature TrickBot
Create hunting rule
File size:413'311 bytes
First seen:2021-07-02 12:07:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9c7729e7e6125436737710b1ba737d7e (4 x TrickBot)
ssdeep 6144:54Gp1gZmFlZKmP4jrc9/5fS9XJqLSYmHiNKhV5X:JrgZm7ZKmP4jrGg9XKg6Kh
TLSH D894E1226641C871D18B11399A7297755EAEBC129BB065CB2FE03EBF6F247C1CF35206
Reporter malwarelabnet
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/169360/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.16209.30574.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/859c57f4-3393-4e7f-a66a-f6b291bfee95
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/811081
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 443492 Sample: triage_dropped_file.dll Startdate: 02/07/2021 Architecture: WINDOWS Score: 72 43 Multi AV Scanner detection for submitted file 2->43 45 Machine Learning detection for sample 2->45 7 loaddll32.exe 1 2->7         started        process3 process4 9 rundll32.exe 7->9         started        12 cmd.exe 1 7->12         started        14 iexplore.exe 1 74 7->14         started        17 3 other processes 7->17 dnsIp5 53 Writes to foreign memory regions 9->53 55 Allocates memory in foreign processes 9->55 19 wermgr.exe 9->19         started        23 rundll32.exe 12->23         started        41 192.168.2.1 unknown unknown 14->41 25 iexplore.exe 2 147 14->25         started        27 WerFault.exe 20 9 17->27         started        signatures6 process7 dnsIp8 29 220.82.64.198, 443, 49739 HSU18035-AS-KRHANSEOUNIVERSITYKR Korea Republic of 19->29 31 icanhazip.com 104.18.6.156, 49741, 80 CLOUDFLARENETUS United States 19->31 37 5 other IPs or domains 19->37 47 Tries to detect virtualization through RDTSC time measurements 19->47 49 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 19->49 51 Delayed program exit found 23->51 33 edge.gycpi.b.yahoodns.net 87.248.118.23, 443, 49735, 49736 YAHOO-DEBDE United Kingdom 25->33 35 dart.l.doubleclick.net 142.250.180.198, 443, 49715, 49716 GOOGLEUS United States 25->35 39 15 other IPs or domains 25->39 signatures9
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c2e5d2f0c63677e5391c6faea8eb8b0da15fcad2b626ea09ae2bafe0144bc2e5/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-07-02 12:07:12 UTC
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev1 banker trojan
Link:
https://tria.ge/reports/210702-cz571enze6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
c2e5d2f0c63677e5391c6faea8eb8b0da15fcad2b626ea09ae2bafe0144bc2e5
MD5 hash:
9f565a7a08363ccf1a6403e4bc232909
SHA1 hash:
a499b437b9c9ade56e47749ee09effa96b88eaf7
Link:
https://www.unpac.me/results/c5d5b305-519e-48a8-9adf-a73b6b0d924f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c2e5d2f0c63677e5391c6faea8eb8b0da15fcad2b626ea09ae2bafe0144bc2e5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/169360/

Comments