MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b080f0a0116db27b5bc345f26209e6cd6630ccc59f96bf2957d350ca044cc04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b080f0a0116db27b5bc345f26209e6cd6630ccc59f96bf2957d350ca044cc04
SHA3-384 hash: 736c8dd8ba649ca8e877f1b431f095bdf832819e1c4fede828dd718da887f0b8e2399c09b6c430732120c70d58073bab
SHA1 hash: b537ad6a4da35085c4e336e7cd80c6c37c3d8c96
MD5 hash: 030fd4dd93baeecc364748cba63ce2c3
humanhash: rugby-music-four-yellow
File name:pops.works_manahet__1488ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'034 bytes
First seen:2020-06-16 22:07:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9B:rpwYGRb+lbUqcl2Ur25Hs5ID
Threatray 2'871 similar samples on MalwareBazaar
TLSH 9CB44AC6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11325/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 22:09:08 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lmea6cqbc3nspnn4grpsmie6ntlggdgmlh4wx4uvpu2qzicezqca._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0b5f544aee9ef5a7bcbdcfddcc59088d75241dc7b55bf4294441521702721022
TrickBot
228afedc197071557d8a1acee8462cc55c9148c8af0b06b8859451c5d843598c
TrickBot
3145ef8b64be8536c9c2fe8536ae0ceccc531ad87b05728e9bd4cc64031a5d02
TrickBot
425a080d23a9b6482c72620ff4e5bc752d25c7f6f4822990969e8b5b3ded908b
TrickBot
a844330bc84aa910a4f4ad13a9d58fe366a950190c8bbb4e41adeeee21152462
TrickBot
be25af0f64b55a10610109888edee51e4d99751adffb8e84135aa2e7b6621c56
TrickBot
ce69760f6b3fb246558e4ff4fa3312af9d7c01460b7ea2dec7c0ef1c0f5dec50
TrickBot
e115e6a5265c115432fc4be5886252e24de7ad91389c7de9618a5c6de235f628
TrickBot
fbcf65b085ba1103c0aab84e586d11f1450ba585cbf98af1d5a812995e1f63f7
TrickBot
fe754310444372c68903eefff0504e26ce37256033cf7c2f9d508497a90bfb08
TrickBot
+ 2'861 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-y9mrw66dl6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/11325/

Comments