MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fe412edff720d39cddbc83e576ae0c2c490b2e6dcbbedce0361760c5b3491b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fe412edff720d39cddbc83e576ae0c2c490b2e6dcbbedce0361760c5b3491b3
SHA3-384 hash: ddcff2abaf6dd656572948de8d3d123d161944f4e2c9af205a39d3a21979ef43c9bb6eb5785c66733e2246124a323171
SHA1 hash: d1f280a96367aaa8b7e02f2c46cd6cc91a381fd0
MD5 hash: 1ed615c7d91029a8be58031935c439b1
humanhash: yellow-zulu-fillet-golf
File name:5fe412edff720d39cddbc83e576ae0c2c490b2e6dcbbedce0361760c5b3491b3
Download: download sample
Signature TrickBot
Create hunting rule
File size:318'473 bytes
First seen:2020-06-03 09:45:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6846196ef528f1b5fd7fc4e7151713d7 (7 x TrickBot)
ssdeep 6144:wTfP21LaDcvLAOo1PNEXDt4lUFHPBNr2ntjy:wT321UECYUU5JNytjy
TLSH 3F64CF11B5E2C072D2B3593005F4A7B56B3EB8620E798A6F17D84B7E4E741C06A39B73
Reporter raashidbhatt
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Gandcrab-6520432-4
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Win.Packer.Crypter-6539596-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Gandcrab
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:32 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-e5lp6632bs/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookAW
Suspicious use of WriteProcessMemory
Adds Run key to start application
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments