🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240
SHA3-384 hash: 1a333cb232a8405435e96647957338ebf8b2c8c4f3cf4230a58f474003f4c97c2d4594425ca6c7efafb5a02447e4440a
SHA1 hash: b81bcd8273854efb7d7b3fb5b982d75051a5d9a6
MD5 hash: eb70b6c24c0466954169882dbe5729a4
humanhash: five-fourteen-eighteen-avocado
File name:netmouser.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:443'904 bytes
First seen:2021-05-04 13:07:31 UTC
Last seen:2021-05-04 13:49:00 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a6618e9400ff529b6609348741f1312c (1 x TrickBot)
ssdeep 12288:mLseU1D6L/hAsEYhbdf6YMvkm2kJYcxpGJ1:mLlS6L/G2f6jv7dJYYpGJ1
Threatray 1 similar samples on MalwareBazaar
TLSH 74941243FC8B454DF1EACBB098702F4EE8321B11A75B1B2F44EA75A8D8163F63146679
Reporter James_inthe_box
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
277
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.Gen.19729.14307.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/710078
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 403966 Sample: netmouser.dll Startdate: 04/05/2021 Architecture: WINDOWS Score: 84 37 www.myexternalip.com 2->37 39 icanhazip.com 2->39 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected Trickbot 2->45 9 loaddll32.exe 1 2->9         started        11 WerFault.exe 2->11         started        13 WerFault.exe 2->13         started        signatures3 47 May check the online IP address of the machine 37->47 process4 process5 15 rundll32.exe 9->15         started        18 cmd.exe 1 9->18         started        20 rundll32.exe 9->20         started        22 rundll32.exe 11->22 injected 24 rundll32.exe 13->24 injected signatures6 57 Writes to foreign memory regions 15->57 59 Allocates memory in foreign processes 15->59 26 wermgr.exe 15->26         started        29 WerFault.exe 23 11 15->29         started        31 rundll32.exe 18->31         started        33 wermgr.exe 20->33         started        process7 signatures8 49 Tries to detect virtualization through RDTSC time measurements 26->49 51 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 26->51 53 Writes to foreign memory regions 31->53 55 Allocates memory in foreign processes 31->55 35 wermgr.exe 31->35         started        process9
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 17:17:16 UTC
File Type:
PE (Sys)
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3zrti7nufv66q3uegja4kkfvnftcaole6ws6ki4hwwn7bf3ejaa._file
Verdict:
unknown
Similar samples:
4d05d391297e3c4ec1bc4047bd3e104f37123c709797854053966ced43f492fb
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:net9 banker trojan
Link:
https://tria.ge/reports/210504-e1w4gwz8ze/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.66.72.217:443
117.252.68.211:443
103.124.173.35:443
115.73.211.230:443
117.54.250.246:443
131.0.112.122:443
102.176.221.78:443
181.176.161.143:443
154.79.251.172:443
103.111.199.76:443
103.54.41.193:443
154.79.244.182:443
154.79.245.158:443
139.255.116.42:443
178.254.161.250:443
178.134.47.166:443
158.181.179.229:443
103.90.197.33:443
109.207.165.40:443
178.72.192.20:443
Unpacked files
SH256 hash:
4ac8dd3d3be4961e16042fee5ea25764cbeb8acacb121fa62d1101df4006d9e7
MD5 hash:
8989fb6ccf22d21d5aea6a28075acd98
SHA1 hash:
f5b06d3784e6b03762efdbfd99ff81651314174a
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/5de80a1d-3c52-4959-a85e-c47ada0adc7f/
SH256 hash:
749883c1eecf9bfbb55fca7c5c636d4360b8b0564a6f7c4f40af6b35613937b6
MD5 hash:
b011766cda9a345c6d9ebe55e96cfe30
SHA1 hash:
958305a15285e9957ac169c630b54791d8c19b85
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/5de80a1d-3c52-4959-a85e-c47ada0adc7f/
SH256 hash:
c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240
MD5 hash:
eb70b6c24c0466954169882dbe5729a4
SHA1 hash:
b81bcd8273854efb7d7b3fb5b982d75051a5d9a6
Link:
https://www.unpac.me/results/5de80a1d-3c52-4959-a85e-c47ada0adc7f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6f319a3eda16bef437421920e2945ab4b3101cb27ad2f291c3dacdf84bb2240

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/1192966/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-04 14:03:22 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0026.002] Data Micro-objective::XOR::Encode Data