🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eac25b873a3da3fa23109a007c3320889f89010df56ae83fec59e5e262e6e510. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eac25b873a3da3fa23109a007c3320889f89010df56ae83fec59e5e262e6e510
SHA3-384 hash: 3e9ca62371f9769677d01c3bc8aa92921737952de6141252777fb7bb80e42b3947a1a1ec3514645478276f16bfd1a3da
SHA1 hash: 90e96f8a02ee5155e757e9d2a547ca0fbf22d207
MD5 hash: af9f00bd331dbd53996a8c9e8eb23cf5
humanhash: oxygen-foxtrot-gee-seventeen
File name:af9f00bd331dbd53996a8c9e8eb23cf5
Download: download sample
Signature TrickBot
Create hunting rule
File size:356'512 bytes
First seen:2021-06-24 09:21:39 UTC
Last seen:2021-06-24 09:45:28 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash b33e28e85f9bd5008d33b6e5ac7cd1e8 (1 x TrickBot)
ssdeep 6144:Eudd569XnnFp34CWH8HGsEQ7YTHVsPLKfPdc:EuddAXFpICWH8HQqmfm
Threatray 2 similar samples on MalwareBazaar
TLSH 4C740210A6E08177D4A61238A8D2DA112B3D6E1522B4414F5FF93E7B7FA17E01F743BA
Reporter zbetcheckin
Tags:32 dll exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
227
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/167956/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.37131238.6633.18905.UNOFFICIAL
Create hunting rule

Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/89c4c352-878e-4edc-9eea-263d51d8d889
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/807344
Signature
Allocates memory in foreign processes
Delayed program exit found
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Sigma detected: CobaltStrike Load by Rundll32
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 439758 Sample: INXz45lkuC.dll Startdate: 24/06/2021 Architecture: WINDOWS Score: 84 45 Multi AV Scanner detection for submitted file 2->45 47 Sigma detected: CobaltStrike Load by Rundll32 2->47 49 Machine Learning detection for sample 2->49 8 loaddll32.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        15 rundll32.exe 8->15         started        signatures5 17 rundll32.exe 10->17         started        57 Writes to foreign memory regions 12->57 59 Allocates memory in foreign processes 12->59 61 Delayed program exit found 12->61 20 wermgr.exe 12->20         started        23 wermgr.exe 15->23         started        process6 dnsIp7 41 Writes to foreign memory regions 17->41 43 Allocates memory in foreign processes 17->43 25 wermgr.exe 17->25         started        29 wtfismyip.com 95.217.228.176, 49717, 80 HETZNER-ASDE Germany 20->29 31 186.97.172.178, 443, 49715 ColombiaMovilCO Colombia 20->31 33 6 other IPs or domains 20->33 signatures8 process9 dnsIp10 35 196.41.57.46, 443, 49714 LIQUID-ASGB Tanzania United Republic of 25->35 37 icanhazip.com 104.18.6.156, 49718, 80 CLOUDFLARENETUS United States 25->37 39 5 other IPs or domains 25->39 51 May check the online IP address of the machine 25->51 53 Tries to detect virtualization through RDTSC time measurements 25->53 55 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 25->55 signatures11
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/eac25b873a3da3fa23109a007c3320889f89010df56ae83fec59e5e262e6e510/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2021-06-16 07:02:21 UTC
AV detection:
19 of 46 (41.30%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
39d7474b63ada6e1a6d60bf32680e06a5265f88439942a37f8be3f668b78c2b2
TrickBot
ab1da8377cc00a708cb0430c6c1ab1963a3a6866534b1b515c409925d660ae56
TrickBot
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot botnet:rob98 banker trojan
Link:
https://tria.ge/reports/210624-8l8shm94gs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Malware Config
C2 Extraction:
196.43.106.38:443
186.97.172.178:443
37.228.70.134:443
144.48.139.206:443
190.110.179.139:443
172.105.15.152:443
177.67.137.111:443
27.72.107.215:443
186.66.15.10:443
189.206.78.155:443
202.131.227.229:443
185.9.187.10:443
196.41.57.46:443
212.200.25.118:443
197.254.14.238:443
45.229.71.211:443
181.167.217.53:443
181.129.116.58:443
185.189.55.207:443
172.104.241.29:443
14.241.244.60:443
144.48.138.213:443
202.138.242.7:443
202.166.196.111:443
36.94.100.202:443
187.19.167.233:443
181.129.242.202:443
36.94.27.124:443
43.245.216.116:443
186.225.63.18:443
41.77.134.250:443
Unpacked files
SH256 hash:
1cc2b07de37656ab72b008d58c2b98c5d2c719663239edac807a6e4d4f19bfb0
MD5 hash:
93933a462907e9eb389bc65129f41fd8
SHA1 hash:
2f823d2de696dfbdeef1c7b54349f382d1a620a9
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/55c617b6-8d48-47b7-b61f-48c12a04f71e/
SH256 hash:
eac25b873a3da3fa23109a007c3320889f89010df56ae83fec59e5e262e6e510
MD5 hash:
af9f00bd331dbd53996a8c9e8eb23cf5
SHA1 hash:
90e96f8a02ee5155e757e9d2a547ca0fbf22d207
Link:
https://www.unpac.me/results/55c617b6-8d48-47b7-b61f-48c12a04f71e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eac25b873a3da3fa23109a007c3320889f89010df56ae83fec59e5e262e6e510

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

DLL dll eac25b873a3da3fa23109a007c3320889f89010df56ae83fec59e5e262e6e510

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1394235/
Cape
Cape
https://www.capesandbox.com/analysis/167956/

Comments