MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56814de68808c4a33679ad72720f8bb864b4092f99b8773d472f13f304f76483. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56814de68808c4a33679ad72720f8bb864b4092f99b8773d472f13f304f76483
SHA3-384 hash: 22ce9472a5dbe224baa517d50654c93f8c5dc5e85bdd9792555a82ea09b82e4c0060620feaf8898292b4372587a53cd2
SHA1 hash: d7150e448cf87bacf60dbf1e70bc5f765e1d561a
MD5 hash: 45b4bf00e5538b9b8c320f7d144f84a3
humanhash: nine-thirteen-nitrogen-nineteen
File name:56814de68808c4a33679ad72720f8bb864b4092f99b8773d472f13f304f76483
Download: download sample
Signature TrickBot
Create hunting rule
File size:318'473 bytes
First seen:2020-06-03 09:46:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6846196ef528f1b5fd7fc4e7151713d7 (7 x TrickBot)
ssdeep 6144:qTfP21LaDcvLAOo1PNEXDt4lUFHPBNr2ntjy:qT321UECYUU5JNytjy
Threatray 78 similar samples on MalwareBazaar
TLSH 2064CF11B5E2C072D2B3593005F4A7B56B3EB8620E798A6F17D84B7E4E741C06A39B73
Reporter raashidbhatt
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Gandcrab-6520432-4
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Win.Packer.Crypter-6539596-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Gandcrab
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 17:14:11 UTC
AV detection:
45 of 48 (93.75%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
044e1fb5fc6ecd58ea3ad131054c27c448312974086e205241768b61f165db3c
TrickBot
0e5c9ddbb8ec46a3af32d51332606dca4ad9a7608f931738035ab8e6190692f4
TrickBot
2e57b874485735adc113736a9602531504c49239abb33a1adeaea91d72e80132
TrickBot
5fe412edff720d39cddbc83e576ae0c2c490b2e6dcbbedce0361760c5b3491b3
TrickBot
6141592a54730e4dc49205165c4b4c11ea62df8f236420e79d78cff20a82cda3
TrickBot
6e00d7416b36a3a45fd6e64d9dfc2b217a426fb22109003b2ada6782989b73f4
TrickBot
a53f639d9fc551902cccea22dacc77b62fac63516d18418c3008c18cd619f993
TrickBot
ba89f7dc0cf7460c81cf90fdfdb3f4a659458f6544108942f5ea44b5f962c98d
TrickBot
c304a479235303c0725cf36845313692e5d9a2d9f7db7e77de3c0d75229c5e0f
TrickBot
e6d2806dc3d2fa9663130b70eb62946e5d504635a91a42324bcaa8e9762754f0
TrickBot
+ 68 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-k8syeedjdn/
Behaviour
Suspicious use of SetWindowsHookAW
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments