MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67c7d05ff12770af0914c568a46adee2f91cda87bc0c68dc38cdbb444ed5eb58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 67c7d05ff12770af0914c568a46adee2f91cda87bc0c68dc38cdbb444ed5eb58
SHA3-384 hash: d8ae3cfdf3671bde672abc548f778401abd2dc1252a2f2d13ccd9f1b3ba9234db13b29d984d69641ee01037d62923b45
SHA1 hash: dff87572ea6031e99275864fefe4d2cf1ae9129b
MD5 hash: b8bde0137d87f1a23a7cfed7e85ea2d3
humanhash: chicken-fanta-romeo-carpet
File name:67c7d05ff12770af0914c568a46adee2f91cda87bc0c68dc38cdbb444ed5eb58
Download: download sample
Signature TrickBot
Create hunting rule
File size:227'337 bytes
First seen:2020-06-03 09:04:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 55c369dd0f95824b70f2ca3110842832 (4 x TrickBot, 2 x GandCrab)
ssdeep 3072:UBbWxYKFDnqvffIj0nStxBN3cwqvcQr3YTfVEPnYbl3/YrDAEioKhAv/:UBkYKZSYYnS1xecmoT2nYbdEKs/
Threatray 73 similar samples on MalwareBazaar
TLSH 3124E121B5CCC87AE166213C49A2DA65AE19FC70C72119CB1FE9067DCF581C2CAF53D6
Reporter raashidbhatt
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Gandcrab-6552923-4
Create hunting rule

Win.Packer.Crypter-6539596-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Gandcrab
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:08:36 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
044e1fb5fc6ecd58ea3ad131054c27c448312974086e205241768b61f165db3c
TrickBot
0d4468410b46f3002718b14ed94ae48269281674b61b7678167206924ef29eb3
TrickBot
6cca3e66e1ca37e84205789ff6bce14ba137da7dc166e606cf10b9b198e120f3
TrickBot
79fc5ee64b7974a44e1e8c5cd6d64aa7a90b1103d510bb6ae0dca6aab031ef9d
TrickBot
7b63849eb25736a10f00ca0abf1322f60a7a16d7f798c9f198a893cfcdba7e47
TrickBot
7f25e53c8b2156c33e343519cb3a5e1c06a7bdea986695e08e5cdfae4af3fd49
TrickBot
8adad3ca7cdd5a453b186cf7bc14d47bdba384d5ad2a734a344be8af5e191139
TrickBot
9316d6daaf6e34ab8a0cb9900a9e6d2d24a417e41c67335b0333590182909324
TrickBot
ba89f7dc0cf7460c81cf90fdfdb3f4a659458f6544108942f5ea44b5f962c98d
TrickBot
c304a479235303c0725cf36845313692e5d9a2d9f7db7e77de3c0d75229c5e0f
TrickBot
+ 63 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-kfv2bxx7ys/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments