🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 069bcdcbf0f691461515568aab2ecd9db9f5adf29fc5f81c9e954987661a0175. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 069bcdcbf0f691461515568aab2ecd9db9f5adf29fc5f81c9e954987661a0175
SHA3-384 hash: 8ce761cf5369ce62a0f04088ad1051f6473baab3c69718edbeb3ec43b2d1dc1a10d99e582c48324cdb96e16bdd0292dd
SHA1 hash: 406620e72d4c74a679cd4f80702cab7303a82ce7
MD5 hash: 49242b4bea1a0ff11007a48d9260ac0e
humanhash: florida-arkansas-pasta-sodium
File name:069bcdcbf0f691461515568aab2ecd9db9f5adf29fc5f81c9e954987661a0175
Download: download sample
Signature TrickBot
Create hunting rule
File size:155'648 bytes
First seen:2020-10-24 21:04:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 43b8010ffc0d3d45362e0daf599a186e (1 x TrickBot)
ssdeep 3072:U7nWt1SP1k/+94pO8dx4ME58Aaw6bXkfSCJ0INiuZX:BW1k/bBdxJwaUfS2dNiwX
TLSH F8E33A233AE990D8C127C17AD965550BF7B33C480B2447EF4360BA662FB66E1BD39391
Reporter seifreed
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/75263/
Detection(s):
Win.Trojan.Trickbot-6335811-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/508694
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject threads in other processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/069bcdcbf0f691461515568aab2ecd9db9f5adf29fc5f81c9e954987661a0175/
Threat name:
Win64.Trojan.Trickster
Create hunting rule
Status:
Malicious
First seen:
2019-01-07 19:59:18 UTC
File Type:
PE+ (Exe)
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a2n43s7q62iumfivk2fkwlwntw47llpst7c7qhe6sveyozq2af2q._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/201024-d2jte8lfcn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
069bcdcbf0f691461515568aab2ecd9db9f5adf29fc5f81c9e954987661a0175
MD5 hash:
49242b4bea1a0ff11007a48d9260ac0e
SHA1 hash:
406620e72d4c74a679cd4f80702cab7303a82ce7
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/502d8bb9-d66f-4a14-87d6-884ac147ece2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trickbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/069bcdcbf0f691461515568aab2ecd9db9f5adf29fc5f81c9e954987661a0175

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/75263/

Comments