MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2e233531d16d15ceb2833709381078c01f0fa19a421aca7f7b522361c5a3a36. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2e233531d16d15ceb2833709381078c01f0fa19a421aca7f7b522361c5a3a36
SHA3-384 hash: 9fbd3c9325d2470fc35617b0bcbc2c90c75504d3ae0fe8ba3b60fee34534390a63a8ca0d3df4e2bbe39f7f5533e89487
SHA1 hash: ea3b6dd173ed20102ae00178634a0e2f4b32e015
MD5 hash: b764f3071c094008620eddd91db54e32
humanhash: queen-bluebird-nineteen-burger
File name:pops.works_manahet__153ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'302 bytes
First seen:2020-06-16 22:11:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9K:rpwYGRb+lbUqcl2Ur25Hs5Iw
Threatray 2'870 similar samples on MalwareBazaar
TLSH 96B44AC6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11352/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 00:02:26 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wlrdguy5c3ivz2zignyjhaihrqa7b6qzuqq2zj7xwurdmhc2hi3a._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
131f16d706a513c2cae5d3f4344002794b6cfe4d57ccc15616020a370126a862
TrickBot
3145ef8b64be8536c9c2fe8536ae0ceccc531ad87b05728e9bd4cc64031a5d02
TrickBot
645d19e305fa06c7f664b112da70f40b02526e80f7b5c597edd1cd16c3f594ef
TrickBot
652e94d6c35d23ea28aaa28875982d14701585ddc3efb72aae4109e2b3f2ae44
TrickBot
69b47b24ade5077dd694765b73e1fb2c16c69d03e39f421d326d0339f98c85b9
TrickBot
7565adff0e2a0c3e8c97944e20575fc9a4df26368af1ddc3092b98a4f6746bff
TrickBot
7d324861e87165c508173d51db088be46f4a5745adbed8eaba55ce0a7ace8826
TrickBot
c66ae4e53584d8507ebe5dddd84e5006b3807c1d5407c0fb16d84062a6637868
TrickBot
fd5c69fecc80d94b0f5dd8e1819b40988a00d1c7b8b189f5576157be4230a4d8
TrickBot
fe754310444372c68903eefff0504e26ce37256033cf7c2f9d508497a90bfb08
TrickBot
+ 2'860 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-l1s8z8qwv6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/11352/

Comments