🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8
SHA3-384 hash: 7efc780d4c2a4c103aea22cbb95c0c2f5da19592441a0d3418656d486da25e07f9c96454f210029c6c9a7e9a48181a5d
SHA1 hash: 9cce08442fdb58b4c96f4627266ce41cf8091237
MD5 hash: 03e6354bab55c9de22001ac0256fb860
humanhash: oranges-minnesota-fish-july
File name:03e6354bab55c9de22001ac0256fb860.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:487'551 bytes
First seen:2021-10-07 09:03:29 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash f34a0f23e05f2c2a829565c932b87430 (15 x TrickBot)
ssdeep 12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Kllp:bEKNb/aZl6KdSrs+p
Threatray 4'052 similar samples on MalwareBazaar
TLSH T1C5A4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter abuse_ch
Tags:dll TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
283
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/195745/
Detection(s):
SecuriteInfo.com.Artemis45BD1517B770.186.19982.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/615eb80998a6280f3933858e/reports/f7d630c7-74e1-4fef-b877-cfa29bd0a8f2/overview
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/866271
Signature
Allocates memory in foreign processes
Delayed program exit found
Early bird code injection technique detected
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Regsvr32 Command Line Without DLL
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 498701 Sample: TsozeiN4tT.dll Startdate: 07/10/2021 Architecture: WINDOWS Score: 100 73 Found malware configuration 2->73 75 Multi AV Scanner detection for dropped file 2->75 77 Multi AV Scanner detection for submitted file 2->77 79 2 other signatures 2->79 8 loaddll32.exe 1 2->8         started        11 rundll32.exe 2->11         started        13 regsvr32.exe 2->13         started        15 rundll32.exe 2->15         started        process3 signatures4 81 Writes to foreign memory regions 8->81 83 Allocates memory in foreign processes 8->83 17 regsvr32.exe 8->17         started        20 cmd.exe 1 8->20         started        22 rundll32.exe 8->22         started        24 2 other processes 8->24 process5 signatures6 65 Writes to foreign memory regions 17->65 67 Allocates memory in foreign processes 17->67 69 Queues an APC in another process (thread injection) 17->69 26 wermgr.exe 2 17->26         started        71 Early bird code injection technique detected 20->71 30 rundll32.exe 20->30         started        32 wermgr.exe 22->32         started        35 iexplore.exe 2 157 24->35         started        process7 dnsIp8 51 58.97.72.83, 443, 49946, 49949 TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH Thailand 26->51 53 136.228.128.21, 443, 49880, 49883 SINET-KHSINETCambodiasspecialistInternetandTelecomS Cambodia 26->53 59 4 other IPs or domains 26->59 85 Tries to detect virtualization through RDTSC time measurements 26->85 87 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 26->87 89 Writes to foreign memory regions 30->89 91 Allocates memory in foreign processes 30->91 93 Delayed program exit found 30->93 37 wermgr.exe 3 30->37         started        55 103.146.232.154, 443, 50047, 50048 WIDENET-AS-INWideNetcomIndiaIN unknown 32->55 57 36.91.88.164, 443, 49987, 49990 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID Indonesia 32->57 61 5 other IPs or domains 32->61 41 C:\Users\user\AppData\...\dvTsozeiN4tTzh.trd, PE32 32->41 dropped 63 29 other IPs or domains 35->63 file9 signatures10 process11 dnsIp12 45 202.9.121.143, 443, 49779, 49830 WORLD-ASWorldStarCommunicationIN India 37->45 47 36.89.228.201, 443, 49878, 49881 TELKOMNET-AS2-APPTTelekomunikasiIndonesiaID Indonesia 37->47 49 2 other IPs or domains 37->49 43 C:\Users\user\AppData\...\uwTsozeiN4tToe.trd, PE32 37->43 dropped file13
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 09:04:17 UTC
AV detection:
22 of 45 (48.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4avb2lx2n3aawfmfhcc3aibqa2qjcagmv7doqov6fpi52dvprxma._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
TrickBot
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
TrickBot
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
TrickBot
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
TrickBot
90affcc89243f2e6f5eed9f89ec42079459510e329abb132a4749fe0817af1eb
TrickBot
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
TrickBot
a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
TrickBot
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
TrickBot
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
TrickBot
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
TrickBot
+ 4'042 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:zvs1 banker trojan
Link:
https://tria.ge/reports/211007-k1nkpscdcr/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
36.91.117.231:443
36.89.228.201:443
103.75.32.173:443
45.115.172.105:443
36.95.23.89:443
103.123.86.104:443
202.65.119.162:443
202.9.121.143:443
139.255.65.170:443
110.172.137.20:443
103.146.232.154:443
36.91.88.164:443
103.47.170.131:443
122.117.90.133:443
103.9.188.78:443
210.2.149.202:443
118.91.190.42:443
117.222.61.115:443
117.222.57.92:443
136.228.128.21:443
103.47.170.130:443
36.91.186.235:443
103.194.88.4:443
116.206.153.212:443
58.97.72.83:443
139.255.6.2:443
Unpacked files
SH256 hash:
2aadcd168cc1e1cc465b57548f32f26f3d45fefe61e072563915ddf826a5b32d
MD5 hash:
165222903380731b1cf87db722b54aa5
SHA1 hash:
cad66a3edd3b3eafa9d9816c40e033f99ef18ed6
Detections:
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/eba7bb2e-acf6-4369-916b-3ca563cd305b/
Parent samples :
a1f2e57c1b2c2432ada62eab1c5e46aa6ccb8685175d3b7cd5343f6028b46df6
2d7133b88414cebe0d520f3701ce77f2b2e1ed9bb08deb4983a43703d6739af0
d4d7324725a1a59e0c85cf5eb41afc3c17618ede3245038675bd91f49cbc8908
9049352f6a1098b44d32448e67f384515da51b516fdaee8892b3d498f3c2a446
57db3ac25a078af4897c0e0074529675c5deae55088709e692c2f1e6beb54cf7
2307eacaaf8da934e5d59e8c82510bb8174a127b1a5832dd581f13c56ddfb105
7648c2583b2f2e47a49f3ca435189ad0b21ec43efade37d98333917285732474
dfa2198d6443e31115a8fafa2909c3047793a77da81b301bc94c44362de81214
eaa6d9eaaacd31815717f5b972982b8ea2a6b8c078b323a4a4989d3161a4f975
37c7c855b9d5d3ab3537c05accac8850fce15b06833f418e658b700c5425ac25
90affcc89243f2e6f5eed9f89ec42079459510e329abb132a4749fe0817af1eb
0e3d9ce252ddfed3baf8dd48a895a2e6b718021abd242626ade783e423c4d96c
a58069f435ecb06e19a354e35a9160af2b62ffd71ffe1099d01b4e56760a2f09
aa63e038af307918e17ab070e9d6e1250d7b5c7457bb109c7db59ec99ead8bff
89932cba5b5d516255703ec625731f812e8939f6c6d64af82019ce3050280a29
e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8
SH256 hash:
6306bbdc63e0ec3720047f5a6e28c67890ad1c8765ceec85cde5889162293b22
MD5 hash:
3409f865936a247957955ad2df45a2cd
SHA1 hash:
be7e5017d762bc10278ddd0c6b7752c50c014ae0
Link:
https://www.unpac.me/results/eba7bb2e-acf6-4369-916b-3ca563cd305b/
SH256 hash:
3dc39f72fc1dd38da7277ffed474b5a3252809038ee23fe60f4232b5f7c7dff2
MD5 hash:
b67694dddf98298b539bddc8cabc255d
SHA1 hash:
7cfdc9b871972066055bdbe586dc8b394b6c0499
Link:
https://www.unpac.me/results/eba7bb2e-acf6-4369-916b-3ca563cd305b/
SH256 hash:
6515084c99478975c73987727e813ea6e8fa8046f425c8e88b54f6eeeea225d8
MD5 hash:
34d6a6bffa656c6b0c7b588e111dbed1
SHA1 hash:
06aea3fd95b58a9a93f7fc2a721c715be6c3b7b1
Link:
https://www.unpac.me/results/eba7bb2e-acf6-4369-916b-3ca563cd305b/
SH256 hash:
e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8
MD5 hash:
03e6354bab55c9de22001ac0256fb860
SHA1 hash:
9cce08442fdb58b4c96f4627266ce41cf8091237
Link:
https://www.unpac.me/results/eba7bb2e-acf6-4369-916b-3ca563cd305b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e02a1d2efa6e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1658646/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/195745/

Comments