MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 238cd63144371389bfac75486fac2f810b117edd983a1d310459ef26986b5d67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 238cd63144371389bfac75486fac2f810b117edd983a1d310459ef26986b5d67
SHA3-384 hash: ea9aef76fcb2481e986b71e41c15587cbdf69ff521f544d5c8d568738e1b52db984dbc9ec89fce6db8864f4f748a6dc2
SHA1 hash: 2ca92b66480d6be5be231ebd0c1d5e0a6dce9c4c
MD5 hash: 6c33bf33786fb43c6406f124e0585458
humanhash: october-fifteen-earth-high
File name:259N8Mk0.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:373'126 bytes
First seen:2020-04-22 10:45:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0885b2b2b5829577912d5197330fc416 (300 x TrickBot)
ssdeep 6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6ANv:WBOO3VKID90TBEhx4O6av
Threatray 2'954 similar samples on MalwareBazaar
TLSH 2284C0013CCFCCF2E4110171C8868BE49679BC2A3E5AD597FBB4295CDAB5381D92B26D
Reporter JoulK
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

SecuriteInfo.com.Trojan.Packed.140.11914.9480.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-19 08:27:13 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eognmmkeg4jytp5moveg7lbpqefrc7w5ta5b2mielhxsngdllvtq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
03703d872a8c3b479d97570406f069fe78d29722bfb585fbc298708ece8f868b
TrickBot
0d62ddbeb425b5b4715637866e4c4e6736909b15ba6360f0ecc68f8ae5da689f
TrickBot
27c3f84dd3101c302afb523ee2c5b728c1fc34cfb8430c314d1f2df5ed79c28c
TrickBot
85f98350c29aa63d0d5c41458f224536c09c1f1c8ab57a41ec5cd34bf58fa56c
TrickBot
9977722c62d428adb75fb5103434958e72c532e70db0338b7caa017d04bc223a
TrickBot
aa8c5489d66d4c8281df1590641f32468dfa0429ff90d1183306f0a81b9915bb
TrickBot
babaa5f246f5b57fc0a02d081f9058990b3069f2bfe683e98b663a86f4b8752d
TrickBot
ca551d1b3c88469dd80ee4010e87c6f2f7953219b827ae09856325c3386dfd0e
TrickBot
d3b0de5c75423bb0000ec0713e245a39d70a76e3e722bd5be161aaee271a4b95
TrickBot
d48a161d94315e34c7f8cc55c25e5b68de363ca49b31a35a8f4af3f83f8a1228
TrickBot
+ 2'944 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 238cd63144371389bfac75486fac2f810b117edd983a1d310459ef26986b5d67

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/343677/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileA
KERNEL32.dll::FindFirstFileA
KERNEL32.dll::GetTempFileNameA

Comments