MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8
SHA3-384 hash: 2fb08b477dff506b0ca00373a7f31f1046b50c42f9d820f912b075bfb4caba1c98526ed299c8e012a1e44dcaa57e3b6a
SHA1 hash: 63ca8b7553b4fd19d9ad9fbe5199656d223a93f2
MD5 hash: 955a8fad4b34c808afa21c1c8692891d
humanhash: virginia-zebra-pasta-yankee
File name:SecuriteInfo.com.Variant.Razy.848795.10426.24069
Download: download sample
Signature TrickBot
Create hunting rule
File size:559'104 bytes
First seen:2021-03-16 08:50:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 882620d0d6df83ec090498c41ffd5fb8 (1 x TrickBot)
ssdeep 12288:sQOIVKgB7z01G3yfoQ0ANqxy9Fx/C3meRdksUQ:m9W08u0x8x/C35/ks
Threatray 3 similar samples on MalwareBazaar
TLSH 4EC4DF31F5984426D4F96E3358B0FFC3D63DA35C9F211A97326C0AAD8B244E09A76B47
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.848795.10426.24069.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0cd751a9-1a4f-4132-ada2-4265eaf85fb2
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/640476
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 369212 Sample: SecuriteInfo.com.Variant.Ra... Startdate: 16/03/2021 Architecture: WINDOWS Score: 100 28 123.200.26.246 LINK3-TECH-AS-BD-APLink3TechnologiesLtdBD Bangladesh 2->28 30 122.2.28.70 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH Philippines 2->30 32 6 other IPs or domains 2->32 44 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->44 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 3 other signatures 2->50 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 cmd.exe 1 9->14         started        16 regsvr32.exe 9->16         started        signatures6 52 Writes to foreign memory regions 11->52 54 Allocates memory in foreign processes 11->54 18 wermgr.exe 11->18         started        21 wermgr.exe 11->21         started        23 iexplore.exe 1 73 14->23         started        process7 signatures8 40 Tries to detect virtualization through RDTSC time measurements 18->40 42 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 18->42 25 iexplore.exe 154 23->25         started        process9 dnsIp10 34 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49733, 49734 YAHOO-DEBDE United Kingdom 25->34 36 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49727, 49728 FASTLYUS United States 25->36 38 10 other IPs or domains 25->38
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8/
Threat name:
Win32.Trojan.Razy
Create hunting rule
Status:
Malicious
First seen:
2021-03-16 07:53:16 UTC
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z6pi6att3cqcolra2nrbog5n4bzx4leywwovyyfpkbyktpfkos4a._file
Verdict:
unknown
Similar samples:
0bf610b97ec21501f19486cbc1e77aec26cea2da6dfa090f2f6f8e32e91419bb
TrickBot
3981026da01dc2db3a957ffd113374c2b442e9d959eb4e78950b903a9e4ab6e3
TrickBot
71b4913ef363073f0ecc4b4c5af3ad4b4889ac7f22a3e34d54c9b6572b83c483
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon93 banker trojan
Link:
https://tria.ge/reports/210316-yazr92wpve/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
0a1bd993e2f06f3a9a548abfb7d40d19b23d7e689d0a778610dca34055b0601b
MD5 hash:
46519c0b72468174a835c280f1dd5571
SHA1 hash:
9ed125eecf0ab665326702f3dc7b313edb5286e3
Link:
https://www.unpac.me/results/592fcf15-5bdf-4190-baa9-ed79490b1116/
SH256 hash:
72d2f54c72ed609cfa5550d04a4a8733ffaee7f648982aa5ff734bf09e5618a9
MD5 hash:
586086de0e713d146bc0b9ecb0158396
SHA1 hash:
cd0dc2dabe5f09d1e1801be58e427b05c470fdc5
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/592fcf15-5bdf-4190-baa9-ed79490b1116/
SH256 hash:
cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8
MD5 hash:
955a8fad4b34c808afa21c1c8692891d
SHA1 hash:
63ca8b7553b4fd19d9ad9fbe5199656d223a93f2
Link:
https://www.unpac.me/results/592fcf15-5bdf-4190-baa9-ed79490b1116/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll cf9e8f0273d8a0272e20d362171bade0737e2c98b59d5c60af5070a9bcaa74b8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1070383/
  
Delivery method
Distributed via web download

Comments