🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5
SHA3-384 hash: 5282c5e758872824c0fcffe2b0cdad83566864137b75be2a9b8dceccc6252a9e4dba2758a1296ca85534b4a1bcfb0cb7
SHA1 hash: 871a743a69e66000e7588bb8858e9991ac8bd154
MD5 hash: 7f3e44cca7dd1841d5d9db9a71b4f3cb
humanhash: xray-whiskey-steak-four
File name:mon117_cr(1).dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:509'440 bytes
First seen:2021-05-07 05:15:39 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 60535399a01b995354b95d8392470467 (2 x IcedID, 1 x TrickBot)
ssdeep 6144:H9R8XkrFueSwOfnAqAitY5JGYMcETCQ1EvLaMGPl+8aubfHRJQwphRqD4:d7rTwGi0JGgETCQRP0DubPRawphok
Threatray 1 similar samples on MalwareBazaar
TLSH DBB4D030F5B48409C9E527B71C99FFC2E43DA3DD6F232697BAAC099DC6108617249B63
Reporter starsSk87264403
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
297
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/152428/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.45870389.4097.13880.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/715582
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses Windows timers to delay execution
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 406722 Sample: mon117_cr(1).dll Startdate: 07/05/2021 Architecture: WINDOWS Score: 96 46 Found malware configuration 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected Trickbot 2->50 52 Yara detected Trickbot 2->52 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 8->15         started        signatures5 66 Writes to foreign memory regions 10->66 68 Allocates memory in foreign processes 10->68 70 Uses Windows timers to delay execution 10->70 17 wermgr.exe 10->17         started        21 cmd.exe 10->21         started        23 rundll32.exe 13->23         started        25 wermgr.exe 15->25         started        27 cmd.exe 15->27         started        process6 dnsIp7 34 123.200.26.246, 449, 49739, 49774 LINK3-TECH-AS-BD-APLink3TechnologiesLtdBD Bangladesh 17->34 36 122.2.28.70, 449 IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH Philippines 17->36 38 3 other IPs or domains 17->38 54 Found potential dummy code loops (likely to delay analysis) 17->54 56 Tries to detect virtualization through RDTSC time measurements 17->56 58 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->58 60 Writes to foreign memory regions 23->60 62 Allocates memory in foreign processes 23->62 64 Uses Windows timers to delay execution 23->64 29 wermgr.exe 23->29         started        32 cmd.exe 23->32         started        signatures8 process9 dnsIp10 40 103.225.138.94, 449 DCNBSI-AS-APDCTVCableNetworkBroadbandServicesIncPH Philippines 29->40 42 201.20.118.122, 449, 49784 MobServicosdeTelecomunicacoesLtdaBR Brazil 29->42 44 3 other IPs or domains 29->44
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5/
Threat name:
Win32.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 23:07:06 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4k5akz5menvcjp6u34zbvz4gb2h6fainxuei4duq2zywpqom2tcq._file
Verdict:
unknown
Similar samples:
038d131f77ce33aa98935bef9318d310ec141e3c0db0b84e4b4679d8a6665151
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:mon117 banker trojan
Link:
https://tria.ge/reports/210507-3ahgel5pra/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
103.225.138.94:449
122.2.28.70:449
123.200.26.246:449
131.255.106.152:449
142.112.79.223:449
154.126.176.30:449
180.92.238.186:449
187.20.217.129:449
201.20.118.122:449
202.91.41.138:449
95.210.118.90:449
Unpacked files
SH256 hash:
cdf8fa2b677a110901b459d7a006394d0503a7f66f00ee81f7df21d1a11c5761
MD5 hash:
d87481130651b71a029d32af13be7a64
SHA1 hash:
cb603868fe3aa213a7df34c15dfdd02aff44b101
Link:
https://www.unpac.me/results/c4f4395d-c296-4818-81be-3791f7834c45/
SH256 hash:
77a45f16547fbf7c9211a3f08ea90229b5390815c63492cc422f94bca0ad8d93
MD5 hash:
82ff4f1748d9eae4f729aaced3ec91b1
SHA1 hash:
7c55477322152b1a3aa74ac67c2b2cbd2b25aa7a
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/c4f4395d-c296-4818-81be-3791f7834c45/
Parent samples :
f604acdbac81768352ca2105a5efb82fb84544e8000a69b3d0a9ac5d557db8b8
e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5
SH256 hash:
e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5
MD5 hash:
7f3e44cca7dd1841d5d9db9a71b4f3cb
SHA1 hash:
871a743a69e66000e7588bb8858e9991ac8bd154
Link:
https://www.unpac.me/results/c4f4395d-c296-4818-81be-3791f7834c45/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll e2ba0567ac236a24bfd4df321ae7860e8fe2810dbd088e0e90d67167c1ccd4c5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1064437/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1064482/
  
URLhaus
https://urlhaus.abuse.ch/url/1070395/
  
URLhaus
https://urlhaus.abuse.ch/url/1077780/
  
URLhaus
https://urlhaus.abuse.ch/url/1077976/
Cape
Cape
https://www.capesandbox.com/analysis/152428/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-07 06:09:55 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation