MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 764553cbeade2cc41c018b08fb22381a32a6c475b86353458d8fbc1aab86afeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 4
| SHA256 hash: | 764553cbeade2cc41c018b08fb22381a32a6c475b86353458d8fbc1aab86afeb |
|---|---|
| SHA3-384 hash: | 88c8986c9aabd0edb00c0da3fbe5f70b10a5855faf017ec44443030e29dcec1485e3feda622bb4779da284ee298071ea |
| SHA1 hash: | 701d69218764e3fa307fffd4632d6ebe95c98293 |
| MD5 hash: | 3158ed9cb3f14df0e9322739607e6322 |
| humanhash: | lemon-ink-uranus-sodium |
| File name: | 104YAs26ZA.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 345'255 bytes |
| First seen: | 2020-03-23 19:02:32 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4eb3f2e4f2eac9862ba327ed0f000854 (1 x TrickBot) |
| ssdeep | 6144:PWTtSNOOswIda4RXUTmwiCR6aR0lgesVOIsZrCC2QcOaF9rFyT:PWTtSswsa49wVstsAIwOmcVXu |
| Threatray | 2'748 similar samples on MalwareBazaar |
| TLSH | E5740103B725E423D68586B8CD76E7BD0727FD594B104ACB26907E6F29373E19E32089 |
| Reporter |  abuse_ch |
| Tags: | exe TrickBot |
abuse_ch
dropped via TrickBot malspam -> web download:HELO: mail.rvcountry.us
Sending IP: 198.50.186.192
From: dealer@rvcountry.us
Subject: Your order approved
Attachment: INVOICE.529.doc
Intelligence
File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Trickbot
Status:
Malicious
First seen:
2020-03-24 03:57:46 UTC
File Type:
PE (Exe)
Extracted files:
50
AV detection:
26 of 31 (83.87%)
Threat level:
2/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 2'738 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
doc 8bec9444c4b418d032bf40d39d3cba08128bba559872483c40f4ad9f74266fc2
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetStartupInfoA |
| WIN_USER_API | Performs GUI Actions | USER32.dll::CreateWindowExA USER32.dll::CreateWindowExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.