MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63ee9c6d54f6aac73500b372ca04e936fd629f6bec8f0b7a8f0f83d7e7fa37b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


FinderBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63ee9c6d54f6aac73500b372ca04e936fd629f6bec8f0b7a8f0f83d7e7fa37b9
SHA3-384 hash: 82efcd65c6dc24910d5d3408d8552cad5c9d52f4ecf92c73de07e2a630cf29dfc2b96313e953cebb62e2d5863f90cf51
SHA1 hash: cc29efb413cd6828229e3df4c856839f44362e59
MD5 hash: 4eb3407f9450f4eaa41664c203f2b8ef
humanhash: princess-uncle-lima-five
File name:63ee9c6d54f6aac73500b372ca04e936fd629f6bec8f0b7a8f0f83d7e7fa37b9
Download: download sample
Signature FinderBot
Create hunting rule
File size:1'589'673 bytes
First seen:2020-06-03 15:02:29 UTC
Last seen:2020-06-03 15:04:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e9c0657252137ac61c1eeeba4c021000 (53 x GuLoader, 26 x RedLineStealer, 17 x AgentTesla)
ssdeep 24576:eOxhZS/P2vZWabYktBQ+Sk7f6LxrKXHVozeVzhf1vrWBf0zECNbr7xN+HdeTDI:xwevZhypEFozeVz5pFYCNbnxNGe3I
Threatray 1 similar samples on MalwareBazaar
TLSH 2A75336A5156E5E8DB47B97102C816CB3FB8C52A481586D38773C3F8B6DC6C8332F968
Reporter raashidbhatt
Tags:exe FinderBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

SecuriteInfo.com.Trojan.GenericKD.42220477.4087.19311.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Trickbot
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 00:37:26 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpxjy3ku62vmoniawnzmubhjg36wfh3l5shqw6upb6b5pz72g64q._file
Verdict:
malicious
Similar samples:
4c19c15867d67267bd79c9304bcdfb4ddb894b4d79cf6e127ba4336ad67ba884
FinderBot
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware
Link:
https://tria.ge/reports/201109-cvenayq3zj/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments