MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 636bd9e9ba2351bb905335e754e7d07e34d329ff8725f8d5a85facb9a88f181b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 636bd9e9ba2351bb905335e754e7d07e34d329ff8725f8d5a85facb9a88f181b
SHA3-384 hash: d212b102102567966bc4656197457e9d9a900b49f52379b08d4e040bc60a362bb6cbe232e4963a879b6ac7861d218ff6
SHA1 hash: 037abc8aa0668aff4699916a9c45d831b7c0c021
MD5 hash: 2bf0afa8f1dfc283348a93e78d251716
humanhash: football-aspen-sad-single
File name:SecuriteInfo.com.Trojan.Agent.ESVA.32133.20314
Download: download sample
Signature TrickBot
Create hunting rule
File size:593'920 bytes
First seen:2020-06-19 23:33:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6f0a80b8515de7f67188be23793fbab5 (14 x TrickBot)
ssdeep 12288:O6XqR7yk6zOPqVakU98MktuIvUrcxI+Fgt1jHxCx09RXB8qQPuzsV1gK0:OB7yk6zOPqVakBuIvUrcxI+Fgt1jRCGz
Threatray 32 similar samples on MalwareBazaar
TLSH FAC47D37F6B8695EF15304B119B5A6B63E2ABC321019910FB380AF1C6972EC7B95131F
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/9860/
Detection(s):
SecuriteInfo.com.Trojan.Agent.ESVA.32133.20314.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 23:36:28 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mnv5t2n2eni3xectgxtvjz6qpy2ngkp7q4s7rvnil6wltkepdanq._file
Verdict:
malicious
Similar samples:
097bc53748a361c51142ae49dad68722f246826ca180351df793e9ea544a3d1c
TrickBot
0dc93ed0d66908d000b3690bad38429c220c089a891972b10b17fcc0acd7aad9
TrickBot
1fad523dab381f349b629778f1b48068ae469f9fa665f2ab2413a46f93c5778e
TrickBot
23315d8eab76bdf171f6021f6b0848654cbef87e1cd9c8be2b3a349744ba2c13
TrickBot
3e2874eee8a1a698d49b2c85ba6a35bd5623f1953ca7b348d3ec3fc916360cca
TrickBot
3f1fead406e75287bf07b6bb2147a8be5b1769b5dd8bf7ef49f5450fae849da0
TrickBot
65638c2a88773a59a06131fb47e182e5b625b391eb1503faba47800b9db91827
TrickBot
8e0081e2bf17fc610c1d75650848999336bfd2f307cd22c24a9a3eacc9620b69
TrickBot
a36e57d89e8b04e21226b86e28db6d5c6e29002cc115da64b58e9c70eea4a0f0
TrickBot
febb5761ae671c134bac0b2542eeecd8c0cd779524fe3c64717f4160e1fbd375
TrickBot
+ 22 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-kccmw46cdn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9860/

Comments