MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4480d5c8dc056a509ae830b314b3e70b682ca935655acab9a138f0329ec9f6dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	4480d5c8dc056a509ae830b314b3e70b682ca935655acab9a138f0329ec9f6dc
SHA3-384 hash:	f9527b94b4c3bf40c58f40a631a518c6dfe634aeda5c0803eba5d162b9f89baf665683463aecc3a913c3235d78bb1e68
SHA1 hash:	61529496f81d4af03a227ed06db46a8c5413757b
MD5 hash:	7eac8f87aba41299691899dde55119ea
humanhash:	edward-robert-mountain-chicken
File name:	SecuriteInfo.com.Trojan.Malware.300983.susgen.13587
Download:	download sample
File size:	594'410 bytes
First seen:	2020-08-25 23:20:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d68a7f00713f10a63b1c459a67eeae6e (16 x BazaLoader)
ssdeep	6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Threatray	122 similar samples on MalwareBazaar
TLSH	DBC49D52F7E449F5D073913ECAA3878AEA72B858473047CB025497192F3B7E19A3E721
Reporter	SecuriteInfoCom

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50859/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Transferring files using the Background Intelligent Transfer Service (BITS)

DNS request

Sending a custom TCP request

Sending a UDP request

Launching the default Windows debugger (dwwin.exe)

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/450518

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Keylogger Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4480d5c8dc056a509ae830b314b3e70b682ca935655acab9a138f0329ec9f6dc/

Threat name:

Win64.Trojan.TrickBot

Status:

Malicious

First seen:

2020-08-25 23:22:24 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Verdict:

malicious

0d1a4934ca9e0f288ed5eff64218807160472e6d227d679fcb82944f3334041a

1a19ad73601c5636654ea6b3167caba9de1c572ab2632b87ce9d702d0dcacf0b

20410eaa1c0ea891b4b57a0f0151c5eb441670f9b564a403c06879620b647b85

26c933957570b2429885df8f0acf438fc7e61c287039c56efe001b9419e2a1f6

55f4c9f3c14d782e52625c95c53a6220cd5f4229fa92129deb488859a26b7ef5

a3e32415676bd0315b133f2b072ba0c4a0090e1888e548c77ef37c25282da4d6

a4cc8f3c31394e314343d0f40c5b9a81f0fa3ac39399f4bafc9666821bc3317d

dc0bca0279910e09caeb1a508eb616d32f3d753f567f050dc04152a9bd587c44

e53568fdb93efa1c69196f7bcbc3c28023cd72d86a2f2d8d4415f04c9334c01e

+ 112 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/200825-tqvfe3befn/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of SetThreadContext

Blacklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4480d5c8dc056a509ae830b314b3e70b682ca935655acab9a138f0329ec9f6dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_uroburos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator