🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d88418d1a937b7d76a18db5d6e58209c27df38b5bb880937db2232bca4ea9b80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d88418d1a937b7d76a18db5d6e58209c27df38b5bb880937db2232bca4ea9b80
SHA3-384 hash: 033d05bfbaa54d669a963b07bbf6fc2a4268438cd6e43e19cf9a2991e9f2eb69bfe87b48a66beb4207ef9f69927c2116
SHA1 hash: 3e786bc28762f20adbab9e821cdc84048a0f7314
MD5 hash: 003a4ba017898adfb1b0e324cdb78fed
humanhash: johnny-low-leopard-carpet
File name:coreForCode.jpg
Download: download sample
Signature TrickBot
Create hunting rule
File size:473'224 bytes
First seen:2021-07-29 16:51:36 UTC
Last seen:2021-07-29 17:39:19 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 87bed5a7cba00c7e1f4015f1bdae2183 (3'034 x Jadtre, 23 x IcedID, 23 x Blackmoon)
ssdeep 6144:7bVPXLakbTqht5o+nKivd8Z4sPYwp4KltOzlZRMCKy6fcWWHDecHAI3C+8hkBx:db4DmavdW4svpLtmRlKMHDuIycx
Threatray 2 similar samples on MalwareBazaar
TLSH T160A4AFFB668C0392E2036879EF18E2B7915367AD6F42C1C5F66AD9D72633092C51CB43
Reporter malware_traffic
Tags:dll Shathak TA551 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
292
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/175118/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Wacatac.Bml.12168.12314.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e70c62de-5b95-41e8-a6c6-84b70d933cc2
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/824029
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Multi AV Scanner detection for submitted file
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 456441 Sample: coreForCode.jpg Startdate: 29/07/2021 Architecture: WINDOWS Score: 100 78 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->78 80 Found malware configuration 2->80 82 Multi AV Scanner detection for submitted file 2->82 84 4 other signatures 2->84 9 loaddll32.exe 1 2->9         started        12 rundll32.exe 2->12         started        14 rundll32.exe 2->14         started        process3 signatures4 94 Writes to foreign memory regions 9->94 96 Allocates memory in foreign processes 9->96 98 Delayed program exit found 9->98 16 rundll32.exe 9->16         started        19 cmd.exe 1 9->19         started        21 iexplore.exe 1 74 9->21         started        23 2 other processes 9->23 process5 signatures6 74 Writes to foreign memory regions 16->74 76 Allocates memory in foreign processes 16->76 25 wermgr.exe 16->25         started        29 rundll32.exe 19->29         started        31 iexplore.exe 150 21->31         started        33 WerFault.exe 23 9 23->33         started        process7 dnsIp8 62 200.236.218.62, 443, 49741, 49749 TelecomSouthAmericaSABR Brazil 25->62 64 88.87.15.96, 443, 49752, 49770 TELNET-ASBulgariaVelikoTarnovoBG Bulgaria 25->64 70 7 other IPs or domains 25->70 100 Hijacks the control flow in another process 25->100 35 svchost.exe 25->35         started        40 svchost.exe 25->40         started        102 Writes to foreign memory regions 29->102 104 Allocates memory in foreign processes 29->104 106 Delayed program exit found 29->106 42 wermgr.exe 29->42         started        66 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49735, 49736 YAHOO-DEBDE United Kingdom 31->66 68 outbrain.map.fastly.net 151.101.14.132, 443, 49737, 49738 FASTLYUS United States 31->68 72 11 other IPs or domains 31->72 signatures9 process10 dnsIp11 52 185.99.133.118, 443, 49772 ZAPPIE-HOST-ASZappieHostGB Belarus 35->52 54 178.132.7.117, 443, 49771 WORLDSTREAMNL Netherlands 35->54 46 C:\Users\user\AppData\Local\...\Web Data.bak, SQLite 35->46 dropped 48 C:\Users\user\AppData\...\Login Data.bak, SQLite 35->48 dropped 50 C:\Users\user\AppData\Local\...\History.bak, SQLite 35->50 dropped 86 Tries to harvest and steal browser information (history, passwords, etc) 35->86 56 14.232.161.45, 443 VNPT-AS-VNVNPTCorpVN Viet Nam 42->56 58 118.173.233.64, 443, 49760 TOT-NETTOTPublicCompanyLimitedTH Thailand 42->58 60 11 other IPs or domains 42->60 88 Writes to foreign memory regions 42->88 90 Tries to detect virtualization through RDTSC time measurements 42->90 92 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 42->92 44 svchost.exe 42->44         started        file12 signatures13 process14
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d88418d1a937b7d76a18db5d6e58209c27df38b5bb880937db2232bca4ea9b80/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-07-29 16:52:06 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
9d1077e6f08763e2eda061f1ac773bd7dbe36bb6aa547abe75163dc46de442cd
TrickBot
d9507158555ccbef8c0e1ea32786fa831678954876e5d54e7454243b65d168de
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zev4 banker trojan
Link:
https://tria.ge/reports/210729-mhdqgdr1ja/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
Unpacked files
SH256 hash:
03785fd170cd7ea05cf88112bdc802e0ad09e23465fb3f4cf12157b1cb545211
MD5 hash:
abe2bf165a001020d07f2200bc3f7e7a
SHA1 hash:
b935e0d78faa742ff0198ab411dfeb5eb41703b4
Link:
https://www.unpac.me/results/17b6d2d2-13a6-4697-bf6e-2b5bd257e707/
SH256 hash:
8931a0dfe2dbc4840e39e37f4cf0c6b6fbf8969eaa03448a9a7d262402775447
MD5 hash:
cfe46def985e296269bb83b8bd636252
SHA1 hash:
13cad93db97c1ac9961f68ae3c063474c1342731
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/17b6d2d2-13a6-4697-bf6e-2b5bd257e707/
Parent samples :
d9507158555ccbef8c0e1ea32786fa831678954876e5d54e7454243b65d168de
d88418d1a937b7d76a18db5d6e58209c27df38b5bb880937db2232bca4ea9b80
a1dd74d7301bf8d504449071142c81113bcd4d0c88fee46e7bacf550495a72bc
SH256 hash:
d88418d1a937b7d76a18db5d6e58209c27df38b5bb880937db2232bca4ea9b80
MD5 hash:
003a4ba017898adfb1b0e324cdb78fed
SHA1 hash:
3e786bc28762f20adbab9e821cdc84048a0f7314
Link:
https://www.unpac.me/results/17b6d2d2-13a6-4697-bf6e-2b5bd257e707/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d88418d1a937b7d76a18db5d6e58209c27df38b5bb880937db2232bca4ea9b80

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175118/

Comments