MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aaa8ac0c72e63597c7dfcffe1486002ca160852863d156ebca8cbdf3cc3ec9d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aaa8ac0c72e63597c7dfcffe1486002ca160852863d156ebca8cbdf3cc3ec9d3
SHA3-384 hash: e55a35fb5ff438458da66a3ff825b84b4e39e5ae5cbdc6abca51365e740743020a585d154381a569dbc5eec44b2ac186
SHA1 hash: 6704737bddebf87e52ac890875b8a7cb0d18ca19
MD5 hash: 499f67908a39d48c6d630057e279908b
humanhash: mountain-nebraska-india-timing
File name:pops.works_manahet__1090ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'139 bytes
First seen:2020-06-16 21:32:52 UTC
Last seen:2020-06-16 21:45:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9H:rpwYGRb+lbUqcl2Ur25Hs5Id
Threatray 5'021 similar samples on MalwareBazaar
TLSH 48B449C6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11115/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 21:34:12 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0b5f544aee9ef5a7bcbdcfddcc59088d75241dc7b55bf4294441521702721022
TrickBot
228afedc197071557d8a1acee8462cc55c9148c8af0b06b8859451c5d843598c
TrickBot
24c65cb2fc7462eede36d38ea5d1f9cbba5410a93e4285316bc9530e46ab6068
TrickBot
b91706b989bfbf51f792945a80fb2c4d7d242e2d22b1bfc767385625e402d6fd
TrickBot
be25af0f64b55a10610109888edee51e4d99751adffb8e84135aa2e7b6621c56
TrickBot
d96cb57e8169882fef1794c17bef5e24eeff88f64be6bc296c6856c9656e2fea
TrickBot
e115e6a5265c115432fc4be5886252e24de7ad91389c7de9618a5c6de235f628
TrickBot
fb47b5136dfb5a52b4aaf305b305bff70cbc92b4358ab40f7557978ff6db2a46
TrickBot
fd5c69fecc80d94b0f5dd8e1819b40988a00d1c7b8b189f5576157be4230a4d8
TrickBot
fe754310444372c68903eefff0504e26ce37256033cf7c2f9d508497a90bfb08
TrickBot
+ 5'011 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-65s13g6v26/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/11115/

Comments