MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2b7e4e5758699f924f50615e8fe48e13bf428d7aa1fcbfb2ed4f64a0fd6a8f93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrochilusRAT
Vendor detections: 10
| SHA256 hash: | 2b7e4e5758699f924f50615e8fe48e13bf428d7aa1fcbfb2ed4f64a0fd6a8f93 |
|---|---|
| SHA3-384 hash: | b0d98b520e856c3cfdbd772b06e8bc15be67275801536f04509adca6f8aa3ea69101666e0ebf79d2a7c6006dd474ddc3 |
| SHA1 hash: | 8d01203d8279404db353a97be2acee79cc9be1cb |
| MD5 hash: | 1634d4a7ffdd698f6ccb541719fbff5c |
| humanhash: | kentucky-summer-harry-victor |
| File name: | 2b7e4e5758699f924f50615e8fe48e13bf428d7aa1fcbfb2ed4f64a0fd6a8f93.exe |
| Download: | download sample |
| Signature | TrochilusRAT |
| File size: | 2'066'944 bytes |
| First seen: | 2022-03-03 08:32:31 UTC |
| Last seen: | 2022-07-24 09:14:54 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a01522d1e6a438332d5131e139326c71 (1 x TrochilusRAT) |
| ssdeep | 49152:1yhZ+bW+qp2UWp9YkieqYftleW4lojGCpMIPJtuqLZHGNloUHKv5ksTAvEypm/jM:16+bW+o7WgkieqYbeW4+jGCpMIP1Gfos |
| Threatray | 18 similar samples on MalwareBazaar |
| TLSH | T1CCA5AF217790907BC57E3632574AA3B9B2F9E9309E35024766A01E7D3E348D2993C27F |
| File icon (PE): |  |
| dhash icon | 787c78fa87f7e6c4 (16 x Gh0stRAT, 11 x Pikabot, 9 x ManusCrypt) |
| Reporter |  obfusor |
| Tags: | exe Plugx TrochilusRAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1634d4a7ffdd698f6ccb541719fbff5c.exe.vir
Verdict:
Malicious activity
Analysis date:
2022-03-03 08:47:38 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
TrochilusRAT
Result
Verdict:
Clean
Maliciousness:
Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Sending a custom TCP request
DNS request
Result
Malware family:
n/a
Score:
9/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CheckScreenResolution
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLeaves
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Signature
Found API chain indicative of debugger detection
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Trochilus
Status:
Malicious
First seen:
2022-03-03 08:33:12 UTC
File Type:
PE (Exe)
Extracted files:
62
AV detection:
15 of 27 (55.56%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 8 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
7b2c8b24ef648979c4e697c5f7203db1e60a67497946d8d45a0f059a8b2a1aa3
MD5 hash:
f3878cbf1d059c6527cd17753043525b
SHA1 hash:
51934edb02ac75d7ccb5a036f22054b692bd55d2
Detections:
win_trochilus_rat_auto
SH256 hash:
f6e97d6ad59103c22a55397a8e63d5736be105f2e3e6428fdde78fcedfcd2863
MD5 hash:
45d52f25e82dd9812fc2954c21e3222d
SHA1 hash:
125485a2ea6f482192117deb0827ccb0a1cd037e
Detections:
win_trochilus_rat_auto
SH256 hash:
2b7e4e5758699f924f50615e8fe48e13bf428d7aa1fcbfb2ed4f64a0fd6a8f93
MD5 hash:
1634d4a7ffdd698f6ccb541719fbff5c
SHA1 hash:
8d01203d8279404db353a97be2acee79cc9be1cb
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.