MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7af6eaed5b4bad18d8b31e5f9ab296c706cd199aa2dbb8332182f3c7767e997. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7af6eaed5b4bad18d8b31e5f9ab296c706cd199aa2dbb8332182f3c7767e997
SHA3-384 hash: c56e91d00e03c20e4765054878d8e6011db2edc820e60cb44847e4e0bcef55a554f7523a461780c47a61e6f1d6955928
SHA1 hash: b632ed6977926f777d786192c497768ed121f90d
MD5 hash: 3883a4a6a1e0bea639ff992d712d914f
humanhash: montana-sierra-venus-grey
File name:pops.works_manahet__1422ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'005 bytes
First seen:2020-06-16 22:03:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9G:rpwYGRb+lbUqcl2Ur25Hs5IY
Threatray 2'878 similar samples on MalwareBazaar
TLSH 6FB44AC6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11285/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 22:05:04 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=66xw5lwvws5nddmlghs7tkzjnrygzumzviw3xazsdaxty53h5glq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0837c3f2451e2f7336d5792d605c03de41fddd56d5dfdea5341171bcd2280f70
TrickBot
1910f4a573118ca3887e34244aad9f79f6754d1ccb7e78c1141e6c8dc6241027
TrickBot
25f7ff6ea6e8e41ef4aa9b17ad7cfec600db1eb216db515b2dfbce744d12a657
TrickBot
2c3723ae043796895afb2aa8e6d465e65e1fc0b22dac84eb3db76f26f220e448
TrickBot
42e45424667f654499511b776d930ffab2947be59d50b555662456363217d32e
TrickBot
450e657b3dc6377837ccc8e2054150d27897c3d6790a2516651286ec9e376fd1
TrickBot
5c9ddbd21e68ba062894606f25e1db79202a400b8fedb3f07bfceabcabe8a190
TrickBot
5ea541876e7031a136495f2a10c434dcea601370b3a6d115e6663261c96b84b3
TrickBot
824c3e1b7f57c8beeb95ab174f8ddcdb37fd9f44628e28b5078f165ba85f290e
TrickBot
ad45ce9d170f99856965affabab85600c4a3ad37c7d37db889921b72b231fb0a
TrickBot
+ 2'868 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-1v1pny754n/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/11285/

Comments