MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e57b874485735adc113736a9602531504c49239abb33a1adeaea91d72e80132. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e57b874485735adc113736a9602531504c49239abb33a1adeaea91d72e80132
SHA3-384 hash: c0ec1a8ba58880713542d359bace9ef5e32484458a05ab1d3aa13ae84221a9bb0a6a5e322b818a4ac87496d6a05760fb
SHA1 hash: dde5b881468ba994afc137477c284d4f4fe8598b
MD5 hash: b8747f01433a143036cfe711f8dfecef
humanhash: delta-bluebird-georgia-july
File name:2e57b874485735adc113736a9602531504c49239abb33a1adeaea91d72e80132
Download: download sample
Signature TrickBot
Create hunting rule
File size:318'473 bytes
First seen:2020-06-03 09:45:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6846196ef528f1b5fd7fc4e7151713d7 (7 x TrickBot)
ssdeep 6144:iTfP21LaDcvLAOo1PNEXDt4lUFHPBNr2ntjy:iT321UECYUU5JNytjy
Threatray 78 similar samples on MalwareBazaar
TLSH 9E64CF11B5E2C072D2B3593005F4A7B56B3EB8620E798A6F17D84B7E4E741C06A39B73
Reporter raashidbhatt
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Gandcrab-6520432-4
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Win.Packer.Crypter-6539596-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Gandcrab
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:36 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
044e1fb5fc6ecd58ea3ad131054c27c448312974086e205241768b61f165db3c
TrickBot
0e5c9ddbb8ec46a3af32d51332606dca4ad9a7608f931738035ab8e6190692f4
TrickBot
56814de68808c4a33679ad72720f8bb864b4092f99b8773d472f13f304f76483
TrickBot
5fe412edff720d39cddbc83e576ae0c2c490b2e6dcbbedce0361760c5b3491b3
TrickBot
6141592a54730e4dc49205165c4b4c11ea62df8f236420e79d78cff20a82cda3
TrickBot
6e00d7416b36a3a45fd6e64d9dfc2b217a426fb22109003b2ada6782989b73f4
TrickBot
a53f639d9fc551902cccea22dacc77b62fac63516d18418c3008c18cd619f993
TrickBot
ba89f7dc0cf7460c81cf90fdfdb3f4a659458f6544108942f5ea44b5f962c98d
TrickBot
c304a479235303c0725cf36845313692e5d9a2d9f7db7e77de3c0d75229c5e0f
TrickBot
e6d2806dc3d2fa9663130b70eb62946e5d504635a91a42324bcaa8e9762754f0
TrickBot
+ 68 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-vqep4252rs/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookAW
Suspicious use of WriteProcessMemory
Adds Run key to start application
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments