🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c55623ca7391cbfbbcdd01a912b6de9893d9989775a4ae5845e2ef659375f162. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c55623ca7391cbfbbcdd01a912b6de9893d9989775a4ae5845e2ef659375f162
SHA3-384 hash: d32b313bdf6aaedb684759ae5f484df442ca882d509973a0170575ed154575c4c697c500eb777476f9a61e1a58de5f6c
SHA1 hash: 2e18cfb987fcf5e70202a50e94f919965ecf387e
MD5 hash: 534ae3d02a470ce727a5eabdb751d22f
humanhash: oscar-comet-illinois-hamper
File name:readytans.png.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:339'456 bytes
First seen:2021-09-01 16:35:16 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9b1adb266f8f339c45ccfafdc830f22f (1 x TrickBot)
ssdeep 6144:bsGb+3pDbr68feSS65+RH9IgOmUQdOfAZ3xirQAX57LIgbo:ov3p/rVfeS5+RtIxKWQA9jb
TLSH T1E57402317290C0B1C16E15322876CBB61ABE39129AF044DB7FF52B7E2FA02D15D7935A
dhash icon 1072f0dcccdc54d4 (2 x TrickBot)
Reporter James_inthe_box
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/184523/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.3522.15372.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/38f01828-c4c3-404e-9440-f41ed9e2d54f
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/843517
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Call by Ordinal
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 475948 Sample: readytans.png.dll Startdate: 01/09/2021 Architecture: WINDOWS Score: 100 87 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->87 89 Found malware configuration 2->89 91 Multi AV Scanner detection for dropped file 2->91 93 8 other signatures 2->93 9 loaddll32.exe 1 2->9         started        11 rundll32.exe 2->11         started        13 rundll32.exe 2->13         started        process3 process4 15 cmd.exe 1 9->15         started        17 rundll32.exe 9->17         started        20 rundll32.exe 9->20         started        24 4 other processes 9->24 22 rundll32.exe 11->22         started        signatures5 26 rundll32.exe 15->26         started        83 Writes to foreign memory regions 17->83 85 Allocates memory in foreign processes 17->85 29 wermgr.exe 17->29         started        32 cmd.exe 17->32         started        34 wermgr.exe 20->34         started        36 cmd.exe 20->36         started        38 wermgr.exe 22->38         started        40 cmd.exe 22->40         started        process6 dnsIp7 97 Writes to foreign memory regions 26->97 99 Allocates memory in foreign processes 26->99 42 wermgr.exe 3 26->42         started        47 cmd.exe 26->47         started        77 105.27.205.34, 443, 49717 SEACOM-ASMU Mauritius 29->77 79 46.99.175.149, 443, 49711, 49716 IPKO-ASAL Albania 29->79 81 7 other IPs or domains 29->81 101 Hijacks the control flow in another process 29->101 103 May check the online IP address of the machine 29->103 105 Tries to detect virtualization through RDTSC time measurements 29->105 107 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 29->107 49 svchost.exe 11 29->49         started        51 svchost.exe 29->51         started        signatures8 process9 dnsIp10 69 185.56.175.122, 443, 49714, 49721 VIRTUAOPERATOR-ASPL Poland 42->69 71 182.253.210.130, 443, 49722 BIZNET-AS-APBIZNETNETWORKSID Indonesia 42->71 75 6 other IPs or domains 42->75 67 C:\Users\user\AppData\...\dbreadytansrz.dmo, PE32 42->67 dropped 109 Hijacks the control flow in another process 42->109 111 Writes to foreign memory regions 42->111 53 svchost.exe 6 42->53         started        57 svchost.exe 42->57         started        73 146.196.122.10, 443, 49723, 49726 CNSINFOTEL-ASCNSInfotelServicesPvtLtdIN India 49->73 file11 signatures12 process13 file14 59 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 53->59 dropped 61 C:\Users\user\AppData\...\Login Data.bak, SQLite 53->61 dropped 63 C:\Users\user\AppData\Local\...\History.bak, SQLite 53->63 dropped 65 C:\Users\user\AppData\Local\...\Cookies.bak, SQLite 53->65 dropped 95 Tries to harvest and steal browser information (history, passwords, etc) 53->95 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c55623ca7391cbfbbcdd01a912b6de9893d9989775a4ae5845e2ef659375f162/
Verdict:
unknown
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob127 banker trojan
Link:
https://tria.ge/reports/210901-thaqnt7yw2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
65.152.201.203:443
185.56.175.122:443
46.99.175.217:443
179.189.229.254:443
46.99.175.149:443
181.129.167.82:443
216.166.148.187:443
46.99.188.223:443
128.201.76.252:443
62.99.79.77:443
60.51.47.65:443
24.162.214.166:443
45.36.99.184:443
97.83.40.67:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
Unpacked files
SH256 hash:
ec38621f1e277704bee19ebf069e2e21afb5563f44f60fb34c6efb36879efd0b
MD5 hash:
8b1262ce370a7ac996b66b1620793c40
SHA1 hash:
198d1075f6e2d6441d7a8abdf7ec599cfc1bb444
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/94b5c6d0-b118-44cf-a827-734fd6677f84/
SH256 hash:
c55623ca7391cbfbbcdd01a912b6de9893d9989775a4ae5845e2ef659375f162
MD5 hash:
534ae3d02a470ce727a5eabdb751d22f
SHA1 hash:
2e18cfb987fcf5e70202a50e94f919965ecf387e
Link:
https://www.unpac.me/results/94b5c6d0-b118-44cf-a827-734fd6677f84/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/c55623ca7391/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c55623ca7391cbfbbcdd01a912b6de9893d9989775a4ae5845e2ef659375f162

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/184523/

Comments