MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929
SHA3-384 hash: 5570a45745309ace407e1a4cd5fac86668647e85e421d54a235fdffe9466024efafb11a68d3026e7cb6209313cdf5934
SHA1 hash: 84ee0b6e02339f1deb33d75693551db444923ba8
MD5 hash: 3ba7d3dbc17ce640e0bb3dd5f989169b
humanhash: tennessee-early-six-fillet
File name:asdpogasdjabn.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:675'840 bytes
First seen:2020-11-09 18:12:36 UTC
Last seen:2020-11-09 20:03:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ba56e34e8a22ac91a660555598e60e39 (5 x TrickBot)
ssdeep 12288:QnYiKoXxtCsm5wRfOlTjRBUU8vg0whwRKCV50robF7z:QtKoXLLmKRWlpBUUP01RKC8EbF/
Threatray 2'894 similar samples on MalwareBazaar
TLSH 6FE4CF123AE2C076C29655324ED6DFB9B2F9E9508B7226C777C40F5D3E34AC1963630A
Reporter James_inthe_box
Tags:exe tar2 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Armadillo-65
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Searching for the window
Creating a window
Creating a file in the %temp% directory
Delayed writing of the file
Deleting a recently created file
Launching a process
Sending a custom TCP request
DNS request
Sending an HTTP GET request
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/526892
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929/
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 18:12:14 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=klnfccc6lrwwkcv7qzvre2gm3aowyczmijhbfad5ycwbo2wizeuq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
05b662e6e0ee03a3e2b87b14fcda6e28f8e048b62f5baeb698068b85d83b1181
TrickBot
09489e108c5b049847f98b97af75418db20af15d9cd727b240b922954b626845
TrickBot
58c4bea082b2f44f0beab5356ae2bc9bc73c3f13ab0491861bc2ba24690da103
TrickBot
5abc66f1c2e2fb7c2d74dbaa17cfa47b1a4f4fc576ef7c842bc1de10bf236e5e
TrickBot
5ec3fca3f0fa3232c85ace8ea62056223149452b70bee259706984e2c96e1998
TrickBot
7eb79859f61d8c17c2311867019dca95098df7f55c0ef00580f1cf7fa904a99f
TrickBot
a46867b0d1a681e81886d2ab962209d39d36aa701cdff18b20159a93db40f1ec
TrickBot
ea5c72bce7e028a6b2f9febd90751bf0e323da00b4b0d68be2a52ed21fe2a4d0
TrickBot
faaa0098ad3de31c95506576653962bf783bdf347b6d22255d707561e30c5350
TrickBot
fbb4e4339bbb0bce98f6de368a927d77cfcd15067f178d80f626da35f9a08981
TrickBot
+ 2'884 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
family:trickbot banker trojan
Link:
https://tria.ge/reports/201109-88dfv8djl2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Looks up external IP address via web service
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Emotet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52da51085e5c6d650abf866b1268ccd81d6c0b2c424e12807dc0ac176ac8c929

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments