MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec8c16d7bdab23143c0b4b41c361e564bfb10f9ceb853f190dc33aaf655fbe5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec8c16d7bdab23143c0b4b41c361e564bfb10f9ceb853f190dc33aaf655fbe5b
SHA3-384 hash: c6ad01b36ad2773c42013f102a85668484642e657c7f6c3700886e0ac17e02e3fa2fe321c15d19fa583a6f72ea9bc141
SHA1 hash: 888e378069991c584e30a6eb1e6bb89bc6198fe8
MD5 hash: c8653499dac5c348b031e24593e10a95
humanhash: magnesium-california-stream-mars
File name:update.bin
Download: download sample
Signature TrickBot
Create hunting rule
File size:444'928 bytes
First seen:2020-06-25 11:58:37 UTC
Last seen:2020-06-25 12:39:32 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 51cd16e014819aa6c3c22645cfee37c9 (2 x TrickBot)
ssdeep 6144:8yBLkTrFAF9m6pmS2dErG42Q6p+WRZ0O7xu5AaDrK5ocx3InYyph+2gvY:/2Twm6p9OEh2Q6pj0O7SAaDuuYe0l
Threatray 5'018 similar samples on MalwareBazaar
TLSH E894AD11F384D031D1A92B344B77C3914BBB7C256EB8C64EA7689A6E1F326418D373E6
Reporter JAMESWT_WT
Tags:TrickBot

Intelligence

File Origin
# of uploads :
3
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/14218/
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Unauthorized injection to a system process
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ec8c16d7bdab23143c0b4b41c361e564bfb10f9ceb853f190dc33aaf655fbe5b/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 11:59:38 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5sgbnv55vmrripaljna4gypfms73cd445oct6ginym5k6zk7xznq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
emotet
Create hunting rule
Similar samples:
5c1df1958b639f2a2fac01fc28190ac4672facd0fe523efdedf2b2a24424d409
TrickBot
7267e26bc4f00c572c149b9bb891607624ef4d8314c7418228c8bccc5e7f7168
TrickBot
852df49eddcced4bfeb403ef5705c9c559e72999f0830447e7c9d51d8437a4e0
TrickBot
8af7651e5c9bbc5e999a745ed4747d9e9e54fb425f824c7438ac07a00f834612
TrickBot
9e9d314dab7a3bf6141ebcd7ca02526e5926150082349eed0afb6cfec7f1e537
TrickBot
ce5011a28ac9275cc13ea71569c48e03810aa407ec9b1518b6ff27cb30efe554
TrickBot
d3490e778e6bab64c1e2e10632335a0f6c58c86155599b22e6b184cf4bf78d83
TrickBot
ea78f793d2de0b9b6da1ddd8530de9c646f3bbaa115f0cbcd7339ddfb5c3b0f7
TrickBot
f0dc0efcd9d6cb23cd57f3b26e390e337d8237f1d699b30196d4eacb1d67b300
TrickBot
f277c22cb2b8fb4a9b318ce5328b04919d53119d2041b67727dcdd587024826f
TrickBot
+ 5'008 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200625-hnhg6wqk3j/
Behaviour
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/14218/

Comments