MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbdf67590cfb1a76b02700a7c91c11ddf0c75f5963e6d56020e983e15a65c5d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbdf67590cfb1a76b02700a7c91c11ddf0c75f5963e6d56020e983e15a65c5d9
SHA3-384 hash: c8b07f73c251d8d4b11647a2f1df6b3eeccae328a8d21fe488fde238cbd4d9a3165313f6b4d2ad1687171b2468da5732
SHA1 hash: 11722b1f0fa7f5467a15e98aa0496679f11f6570
MD5 hash: e136a977901a98fb11493370926cfcf6
humanhash: october-cold-alabama-mexico
File name:joinpornhub.pdf.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:397'312 bytes
First seen:2021-07-28 16:17:33 UTC
Last seen:2021-07-28 16:49:56 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 0cc847421006f34ce0abae8731017938 (1 x TrickBot)
ssdeep 6144:3wi7sK+CK0KLSGcUeinKOo15usoj8VOqR6Pu64LQTK:j/KWzinKnboj8sqRds2
Threatray 3'638 similar samples on MalwareBazaar
TLSH T1A2848D06422428BED98508BDCDCBAAD20B50DA7572BECD85FB98FC7EF5130E091D5297
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter James_inthe_box
Tags:dll rob114 TrickBot

Intelligence

File Origin
# of uploads :
3
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174721/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.24324.2282.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/01854cef-ca3c-4f6d-8506-3b7cb9d56417
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/823421
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hijacks the control flow in another process
Initial sample is a PE file and has a suspicious name
May check the online IP address of the machine
Sigma detected: CobaltStrike Load by Rundll32
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Suspicious Call by Ordinal
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 455834 Sample: joinpornhub.pdf.dll Startdate: 28/07/2021 Architecture: WINDOWS Score: 100 74 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->74 76 Found malware configuration 2->76 78 Yara detected Trickbot 2->78 80 4 other signatures 2->80 10 loaddll32.exe 1 2->10         started        12 rundll32.exe 2->12         started        14 rundll32.exe 2->14         started        process3 process4 16 rundll32.exe 10->16         started        19 cmd.exe 1 10->19         started        21 rundll32.exe 10->21         started        23 rundll32.exe 12->23         started        signatures5 70 Writes to foreign memory regions 16->70 72 Allocates memory in foreign processes 16->72 25 wermgr.exe 16->25         started        29 cmd.exe 16->29         started        31 rundll32.exe 19->31         started        33 wermgr.exe 21->33         started        35 cmd.exe 21->35         started        37 wermgr.exe 23->37         started        39 cmd.exe 23->39         started        process6 dnsIp7 58 60.51.47.65, 443, 49753, 49758 TMNET-AS-APTMNetInternetServiceProviderMY Malaysia 25->58 60 204.138.26.60, 443, 49741 NTT-COMMUNICATIONS-2914US United States 25->60 62 11 other IPs or domains 25->62 82 Hijacks the control flow in another process 25->82 84 May check the online IP address of the machine 25->84 86 Writes to foreign memory regions 25->86 90 2 other signatures 25->90 41 cmd.exe 1 25->41         started        88 Allocates memory in foreign processes 31->88 43 wermgr.exe 3 31->43         started        48 cmd.exe 31->48         started        signatures8 process9 dnsIp10 50 conhost.exe 41->50         started        64 185.56.76.28, 443, 49762 GRUPOINFOSHOPES Spain 43->64 66 185.56.76.94, 443 GRUPOINFOSHOPES Spain 43->66 68 12 other IPs or domains 43->68 56 C:\Users\user\AppData\...\cqjoinpornhubmu.grf, PE32 43->56 dropped 92 Hijacks the control flow in another process 43->92 94 Writes to foreign memory regions 43->94 52 cmd.exe 1 43->52         started        file11 signatures12 process13 process14 54 conhost.exe 52->54         started       
Gathering data
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
7c19373d58728b0e1b36cf30af5dca5eb5975acaaf2b8b0eeac0f87a4f82ce06
TrickBot
a3b6b719ce886b1b47b5e1d94d5d017c6bd58d3732ee3d43e0557b6395a87401
TrickBot
ab31cadce548ff34783ae6a838a3ece8484f4c96b02de8c9b314c0f96c064ab7
TrickBot
b161eb34e5513131f4b0a4c0318646ed3448122445d7924e03ff5822a6e2d2dd
TrickBot
cd7f39f9f95a1161878980631e4069057e715e84bf3ecf940bfca97ce5a96e20
TrickBot
e07cef58aa29455209f32ef23249c9dbfc14dcb79b129dcef040f84aec0253fb
TrickBot
faba77692acd1b52614d6379b4f197af178119baef932ee3157098e3bbcceef7
TrickBot
fda93931bb0b67a61cae3acdae38a66fba556813a194239c0391819b3dbfed26
TrickBot
fe91dea9457e5d92d63cb97758a278939ef33b0529bce694dba57d2db5caedee
TrickBot
+ 3'628 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob114 banker trojan
Link:
https://tria.ge/reports/210728-vq2csehsha/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
38.110.103.124:443
185.56.76.28:443
204.138.26.60:443
60.51.47.65:443
74.85.157.139:443
68.69.26.182:443
38.110.103.136:443
38.110.103.18:443
138.34.28.219:443
185.56.76.94:443
217.115.240.248:443
24.162.214.166:443
80.15.2.105:443
154.58.23.192:443
38.110.100.104:443
45.36.99.184:443
185.56.76.108:443
185.56.76.72:443
138.34.28.35:443
97.83.40.67:443
38.110.103.113:443
38.110.100.142:443
184.74.99.214:443
103.105.254.17:443
62.99.76.213:443
82.159.149.52:443
38.110.100.33:443
38.110.100.242:443
185.13.79.3:443
Unpacked files
SH256 hash:
ac29b0fee4ae6c9ac05ef722b3761f7b63311cfdad79d54fcd9b40b0d6dd3082
MD5 hash:
7e91c382733018695cb669ad25b8907b
SHA1 hash:
cf069e5e8e03abfa085bf9a28e59e946a42e98ad
Link:
https://www.unpac.me/results/2d5f376a-1a43-42fa-b2d7-39017e9d7599/
SH256 hash:
a22f5227f89b665cb554c7d422b12de61bc0cbc5d68e80e274aa488e01eea4f5
MD5 hash:
5bca9e1a00daeb4301c715d19e19995c
SHA1 hash:
93d45c158b3f3ba556acfd23b25a52fc27cc8d36
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/2d5f376a-1a43-42fa-b2d7-39017e9d7599/
SH256 hash:
edd45a567a71208c9c17e3f4c065400ca1faaaf8a97ebaa912af0d09230faea9
MD5 hash:
3389b92a950f3bc1ea49649bb17b984e
SHA1 hash:
578a75dcf5bc246828bd26826a5afcaf07447da2
Link:
https://www.unpac.me/results/2d5f376a-1a43-42fa-b2d7-39017e9d7599/
SH256 hash:
873a2a132ba03db91dfea792fc718441bbfc860fdb1e98cf83d341551986a6b0
MD5 hash:
b7856ef8607902c5b3c79279af3f83db
SHA1 hash:
2528706743edd3985a30501d0a0c1ea56516f6f6
Link:
https://www.unpac.me/results/2d5f376a-1a43-42fa-b2d7-39017e9d7599/
SH256 hash:
dbdf67590cfb1a76b02700a7c91c11ddf0c75f5963e6d56020e983e15a65c5d9
MD5 hash:
e136a977901a98fb11493370926cfcf6
SHA1 hash:
11722b1f0fa7f5467a15e98aa0496679f11f6570
Link:
https://www.unpac.me/results/2d5f376a-1a43-42fa-b2d7-39017e9d7599/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dbdf67590cfb1a76b02700a7c91c11ddf0c75f5963e6d56020e983e15a65c5d9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/174721/
  
URLhaus
https://urlhaus.abuse.ch/url/1487743/

Comments