MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c
SHA3-384 hash: 7435220fadfdef776202671d5d70321d07e04612fb57e0f30a0ac387e1983777d181bc1bd0f8a40578acd97f4cbe53a1
SHA1 hash: da2e6c939259e4435a335b360398cbff7a6e3ffb
MD5 hash: 58dce784a93abeb2b6b462d1a75e9e8a
humanhash: high-salami-river-sodium
File name:58dce784a93abeb2b6b462d1a75e9e8a.dll
Download: download sample
Signature TrickBot
Create hunting rule
File size:884'795 bytes
First seen:2021-04-07 14:52:46 UTC
Last seen:2021-04-07 17:50:56 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 0a018560a180590f4385e7ef8943a2dc (1 x TrickBot)
ssdeep 12288:HZA7fTLrsLYD3Hy9D2s/DSmfxSVp4D9RLb3ZIX83uRq:05DXy9DTo3QRLbpS832q
Threatray 521 similar samples on MalwareBazaar
TLSH FD15BF1231A0C176E2EF02704A16AF7972F5ED208F7A65C3FB804B6D0D779C6973A166
Reporter abuse_ch
Tags:dll rob45 TrickBot

Intelligence

File Origin
# of uploads :
3
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/132872/
Detection(s):
SecuriteInfo.com.generic.ml.18659.18898.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/668827
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Found potential dummy code loops (likely to delay analysis)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Uses Windows timers to delay execution
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 383343 Sample: bYOKxIXRKz.dll Startdate: 07/04/2021 Architecture: WINDOWS Score: 100 38 Found malware configuration 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 Yara detected Trickbot 2->42 44 Yara detected Trickbot 2->44 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 25 8->10         started        13 cmd.exe 1 8->13         started        15 rundll32.exe 16 8->15         started        signatures5 46 Writes to foreign memory regions 10->46 48 Allocates memory in foreign processes 10->48 50 Uses Windows timers to delay execution 10->50 52 Delayed program exit found 10->52 17 wermgr.exe 10->17         started        20 rundll32.exe 16 13->20         started        22 wermgr.exe 15->22         started        process6 signatures7 26 Found potential dummy code loops (likely to delay analysis) 17->26 28 Tries to detect virtualization through RDTSC time measurements 17->28 30 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 17->30 32 Writes to foreign memory regions 20->32 34 Allocates memory in foreign processes 20->34 36 Uses Windows timers to delay execution 20->36 24 wermgr.exe 20->24         started        process8
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c/
Threat name:
Win32.Trojan.Trickpak
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 14:53:05 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=46zzemwammibubyjvv2sppqo7zrig7nctc5rnmx2zgup7lohz4ga._file
Verdict:
malicious
Similar samples:
1e472b9de49871cbf3a381b560312a55163a196213329fdae34f4bbae6dd9d20
TrickBot
330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52
TrickBot
57923313973c7955afed23ce377688c7eb1cc088423f0678206b3fb16bd433ec
TrickBot
75ef968283165b8a4fc163a383e2b28a210544fc10c05c914141f36c747ed23e
TrickBot
77b7bbf78f7a14d808b61a23ea7b29c2bc2e3d8faf62bccf3459182730ea42e3
TrickBot
8c206ff3cf89ee0ddf05f2608ef0535b7a2c17710e6ccec34ec6439d417dab69
TrickBot
8f98d0e1c30fd1a365380df0aef7e89cd29ba92dc26bd1da389987616470862c
TrickBot
9b0e9af1fb6256e923004e97d15a9cbb180b2e6384126b4a1588cfcd04ba7e78
TrickBot
ac17e1f54b9f800d874e1d012e541fc037bd1a31ee3e8f631a454f2d1de6ada1
TrickBot
fd3af0e7890546cc6e6ee828df5a31a4c88c587f968b0298a672b703bf71b7e4
TrickBot
+ 511 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob45 banker trojan
Link:
https://tria.ge/reports/210407-tcxf9t4d32/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Templ.dll packer
Trickbot
Malware Config
C2 Extraction:
89.250.208.42:449
182.253.184.130:449
31.211.85.110:443
85.112.74.178:449
102.68.17.97:443
103.76.150.14:443
96.9.77.142:443
91.185.236.170:449
87.76.1.81:449
91.225.231.120:443
62.213.14.166:443
81.95.45.234:449
148.216.32.55:443
109.185.139.90:449
202.166.211.197:443
196.41.57.46:449
84.21.206.164:449
190.122.168.219:443
77.95.93.132:449
41.77.134.250:443
87.116.151.237:449
185.205.250.162:443
103.9.188.23:449
78.138.187.231:443
138.185.72.142:443
173.81.4.147:443
31.134.124.90:443
200.90.11.177:449
5.59.205.32:443
Unpacked files
SH256 hash:
2e0429aafedd060e0d39d97e867c8e36faba47c18dde0510b3c921fc59681772
MD5 hash:
f317021ba2c5392b7479ae484c60adab
SHA1 hash:
19ea351ee7d40dbf29c34d239602e7904f9ef2ab
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/43b012e0-b987-4156-a7c9-b7830a61729a/
Parent samples :
e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c
54f6fe3e63891e2c0b925cf17385c6df56d824cee163111e93fef76c6476a535
SH256 hash:
1cda8d83acaa943efa9fbd47903d0f7cdd97088702a0c88e7644073c200b6ee8
MD5 hash:
784c7b3c4131cf0f8ac3d38feb1f378b
SHA1 hash:
40456136140ba98efceaad23467f0e784435f15d
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/43b012e0-b987-4156-a7c9-b7830a61729a/
SH256 hash:
cc9964fa698177e834e158e14d00dcf06139f72c292e14f45c91363525e4bd0b
MD5 hash:
f74a1c6589caa918f34930d82acb8854
SHA1 hash:
a70c7e2af16d2b2018de65957ddfe8cbaba50e2e
Detections:
win_trickbot_a4
Create hunting rule
Link:
https://www.unpac.me/results/43b012e0-b987-4156-a7c9-b7830a61729a/
SH256 hash:
e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c
MD5 hash:
58dce784a93abeb2b6b462d1a75e9e8a
SHA1 hash:
da2e6c939259e4435a335b360398cbff7a6e3ffb
Link:
https://www.unpac.me/results/43b012e0-b987-4156-a7c9-b7830a61729a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll e7b39232c063101a0709ad7527be0efe62837da298bb16b2fac9a8ffadc7cf0c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1103746/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/132872/

Comments