MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 46f61998e537ab7d039447132b1233c9952282c8288d43da4067df1de2a42e4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 4
| SHA256 hash: | 46f61998e537ab7d039447132b1233c9952282c8288d43da4067df1de2a42e4c |
|---|---|
| SHA3-384 hash: | 5a814e2110e9575b2a614e814d2f2a250037318924517837dbc7f3593dd2904ef5eeef28b7c5c148d6ebbbb7e13ac797 |
| SHA1 hash: | e55996ca0bd4360c9396171ce790cfc65acb5162 |
| MD5 hash: | ced46f1ffe2fa7d75f603bcd1668e642 |
| humanhash: | double-ack-september-september |
| File name: | 2021APT-28_48630453.zip |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 53'782 bytes |
| First seen: | 2021-07-29 05:12:11 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 1536:ulPdWaaN/M3sI+dw340uILpcEFk1FSapln/t0434x:QVW5wsI+dy7Pk1FxH/GH |
| TLSH | T10433F271F049D10E1C7626FD2F883BC2AAF65844E679D1ADD19D9882A410FA27076B3F |
| Reporter |  cocaman |
| Tags: | TrickBot zip |
cocaman
Malicious email (T1566.001)From: ""T G" <bill@sangbaru.xyz>" (likely spoofed)
Received: "from sangbaru.xyz (sangbaru.xyz [95.142.40.133]) "
Date: "Wed, 28 Jul 2021 19:38:55 +0300"
Subject: "files"
Attachment: "2021APT-28_48630453.zip"
Intelligence
File Origin
# of uploads :
1
# of downloads :
528
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Script.Downloader.SLoad
Status:
Malicious
First seen:
2021-07-29 05:13:13 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
3 of 46 (6.52%)
Threat level:
3/5
Detection(s):
Malicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://smart-integrator.hr/pornhub.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
js Delivery method
Distributed via e-mail attachment
Dropping
TrickBot
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.