MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dc93ed0d66908d000b3690bad38429c220c089a891972b10b17fcc0acd7aad9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0dc93ed0d66908d000b3690bad38429c220c089a891972b10b17fcc0acd7aad9
SHA3-384 hash: 973cff7c60463746dc9b6db9dfac8374383cb72bdf3beba6dbbff9405c5da804d53b6e0dffeaadbebf8bad3fcec58c51
SHA1 hash: f066cfae9c4e5555ac6077569c11fb8bb7027fd6
MD5 hash: 76099aa07fa430ca0a6ae6432dc3b7f2
humanhash: fourteen-nevada-violet-cola
File name:SecuriteInfo.com.Trojan.Packed.140.17151.31279
Download: download sample
Signature TrickBot
Create hunting rule
File size:593'920 bytes
First seen:2020-06-20 02:34:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6f0a80b8515de7f67188be23793fbab5 (14 x TrickBot)
ssdeep 12288:O6XdR7yk6zOPqVakU98MktuIvUrcxI+Fgt1jHxCx09RXB8qC/FEucAdq4gZt2w:OC7yk6zOPqVakBuIvUrcxI+Fgt1jRCG5
Threatray 601 similar samples on MalwareBazaar
TLSH 3BC48D37F6B8695EF15300B119B5A6B57E2ABC322019910BB380AF1C2972EC7BD5171F
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9875/
Detection(s):
SecuriteInfo.com.Trojan.Packed.140.17151.31279.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-20 02:35:23 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0159364dc4a13deea8595d019b3c1e44ca100690b3d7f2df7d79cfd86d4b36ce
TrickBot
23315d8eab76bdf171f6021f6b0848654cbef87e1cd9c8be2b3a349744ba2c13
TrickBot
3e2874eee8a1a698d49b2c85ba6a35bd5623f1953ca7b348d3ec3fc916360cca
TrickBot
636bd9e9ba2351bb905335e754e7d07e34d329ff8725f8d5a85facb9a88f181b
TrickBot
65638c2a88773a59a06131fb47e182e5b625b391eb1503faba47800b9db91827
TrickBot
800403949e76ea5119dbca660ef59120b819557a9db2208dd52345855399c0b5
TrickBot
8e0081e2bf17fc610c1d75650848999336bfd2f307cd22c24a9a3eacc9620b69
TrickBot
a36e57d89e8b04e21226b86e28db6d5c6e29002cc115da64b58e9c70eea4a0f0
TrickBot
d4ca2d9c08113fa653ca0f9b2ef9fcbed2c7e045c6155662254a959a19b13c60
TrickBot
febb5761ae671c134bac0b2542eeecd8c0cd779524fe3c64717f4160e1fbd375
TrickBot
+ 591 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-5tdcxwyt7x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9875/

Comments