MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70d0d2dd36e44793f570239d2189147ef0854bf20e52060818d09eb99af8acad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70d0d2dd36e44793f570239d2189147ef0854bf20e52060818d09eb99af8acad
SHA3-384 hash: df38efe6fd45f9cba1010a9703eb8b75a7fea7f1d6f1ce140c1fac3bb857e8d318a828c6c018378392035f6a5db2cb76
SHA1 hash: fdb4e91b6c58ebaf79a0b29df27b578680440c89
MD5 hash: 1c8c7ecf1675c8d6dbf392ba8f12c8dc
humanhash: oven-wolfram-north-mirror
File name:pops.works_manahet__883ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'271 bytes
First seen:2020-06-17 00:07:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9i:rpwYGRb+lbUqcl2Ur25Hs5Ig
Threatray 2'879 similar samples on MalwareBazaar
TLSH 4DB449C6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12298/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 00:15:11 UTC
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0582a20a439111c0a18e84658ffb290014bee90e74c12caef39beba22b0418f1
TrickBot
1696f98cc304115da77d31975e9b559978fd778977080600902bb3c707640f7a
TrickBot
1ec11c522299b1e0a5899b764c316956e943fe6f60a0e284a7feeaa365481334
TrickBot
6560ba1a1c5046ef58b32c96871949ea41a50f943977216b8b59a462e93ec58d
TrickBot
7e0e4213e2b0207c0c3e69261336e0fa6854b3aa1d5a77d81b1ca1951127d3d0
TrickBot
7f134475fbf846a764701be5dc8cf049c3782c22ac777864525794566ae4805c
TrickBot
82b27c0dd543c2bd730515021ae16871b5bbb2c2b224d09fb5de595d89c82de7
TrickBot
bf2891385e18a4056bdcb22725d609c657846acb6e447306dbe023c336aee2e0
TrickBot
e84ba0a52fb353e76c6a2b4cda4af548bb80efd4fbfae3779cb5a989e80c93c7
TrickBot
f2aa997c25eb1f3cb4628c7c503dfeeafef6fa90f8db347c3e84b3d9d0ba4221
TrickBot
+ 2'869 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-2yrvfcdwe6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/12298/

Comments