MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de
SHA3-384 hash: 1be7eaae73cf8a76665c1ceb6f3525768e5cb63fa973698ddaff6b6926be77b14d4e9735b2a8842e8bbf2a7c171e724a
SHA1 hash: d2c0dfdd419db0ab8c048131dfaf6b597f60aa1f
MD5 hash: 4a4ecfe12c4ce7f9ab8f5812cfcf50ec
humanhash: nebraska-fish-wolfram-item
File name:4a4ecfe12c4ce7f9ab8f5812cfcf50ec.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:1'980'928 bytes
First seen:2021-11-23 09:04:29 UTC
Last seen:2021-11-23 11:06:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d31639bc44b992226d49e6ecf1a2a248 (5 x TrickBot)
ssdeep 49152:+BQhCnUUbPhzn++Z3vrOzYN/z8PcrpQiX:
Threatray 4'312 similar samples on MalwareBazaar
TLSH T1C395C190338872E7F68BE53B5330983AB26639F57A6790C89BD37F4D586EE404F24941
File icon (PE):PE icon
dhash icon 787c78fa87f7e6c4 (16 x Gh0stRAT, 11 x Pikabot, 9 x ManusCrypt)
Reporter abuse_ch
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
890
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4a4ecfe12c4ce7f9ab8f5812cfcf50ec.exe
Verdict:
Suspicious activity
Analysis date:
2021-11-23 09:44:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fe858c9e-9c73-4e9f-8ebd-c8cb97f42dd6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.17021.311.27043.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a file in the %temp% directory
DNS request
Launching a process
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm
Link:
https://www.filescan.io/uploads/619caec7f36138de3f36bb9f/reports/cf490be8-0230-46df-a872-4056f0dde7e8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/34041291-cdc6-4015-a807-56f5d868dfe3
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/894532
Signature
Multi AV Scanner detection for submitted file
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de/
Threat name:
Win32.Infostealer.Trickster
Create hunting rule
Status:
Malicious
First seen:
2021-11-23 09:05:20 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0d8f71039695b040b07f1d5781b4ef5e50b318532eb1139b5de954f13c6751ae
TrickBot
2a039fd90e9150cf1caacb66326d0a3aae6f050c6d0a20e0adbaa2a2e3025450
TrickBot
2dc0f0bc555a5419b0cf12e7368c8009b09fe5c0a6de7867a473c418c7da3dfb
TrickBot
49e61873c2864b4a39bfb6c520ea9644d1b38088cd11a6d0f2f6ced91b793856
TrickBot
59ebd6bc57fb358ceb738d4ebd339910a443b21285f6efb7fb5bd784ff9f3e20
TrickBot
c988a65d39f617c531454c2f15971c0a769d42ac84bea0a7a3bd89394ba3e654
TrickBot
d423f00832f44b4195a686c691b2f20e55bd4c31145a43561f83f1ea661bfc60
TrickBot
d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968
TrickBot
def94d349e3c5637e40dcf603fd7c41d8807f13c0804bea48f1e098fd7629578
TrickBot
f723a66d74e36a5e249a72c8f2a4cc4a7a313ecbf83198df5d377bb52f452768
TrickBot
+ 4'302 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211123-k1794shfdj/
Unpacked files
SH256 hash:
e177d899ad1fe93863e30a44fe7adcdbe6cbde5594c9ffe63115592fb2a39de0
MD5 hash:
4610eeac2606fb87588f945a68575a6b
SHA1 hash:
bfe3f6d3fb86a6538b3364e966abafb647eed021
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/019456b5-72d4-4eb5-a198-2013af2a73bd/
Parent samples :
2a039fd90e9150cf1caacb66326d0a3aae6f050c6d0a20e0adbaa2a2e3025450
d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968
0d8f71039695b040b07f1d5781b4ef5e50b318532eb1139b5de954f13c6751ae
e177d899ad1fe93863e30a44fe7adcdbe6cbde5594c9ffe63115592fb2a39de0
c988a65d39f617c531454c2f15971c0a769d42ac84bea0a7a3bd89394ba3e654
355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de
SH256 hash:
d6bc98ffb20d99fb776549d9ade851c1c0b7c64e5f445fc25ce6a32f5e0c010a
MD5 hash:
b7e5e6246dccc245d4b1849f8898e032
SHA1 hash:
3ecaed1f56ab860120873b5a71f8d4b227915f05
Link:
https://www.unpac.me/results/019456b5-72d4-4eb5-a198-2013af2a73bd/
SH256 hash:
355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de
MD5 hash:
4a4ecfe12c4ce7f9ab8f5812cfcf50ec
SHA1 hash:
d2c0dfdd419db0ab8c048131dfaf6b597f60aa1f
Link:
https://www.unpac.me/results/019456b5-72d4-4eb5-a198-2013af2a73bd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/355d4c4c8eab/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/208613/
  
URLhaus
https://urlhaus.abuse.ch/url/1805321/
  
Delivery method
Distributed via web download

Comments