MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 795537b118a578aebaf17466c58d72b02285268b8171be3d443e4cf4cca261ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 795537b118a578aebaf17466c58d72b02285268b8171be3d443e4cf4cca261ef
SHA3-384 hash: b4f631ca4a6d418cb96725f053f680118c7be92995b02e38dc0eac14d29ec0e068371b380b0e8c296b97dcacf018d9f1
SHA1 hash: 5c01b08fab1e5ea5a3df34dde1b7c809d3f6880d
MD5 hash: d5fe65e706bd3cbff1f4ae3fe66e2e31
humanhash: september-stairway-lima-carpet
File name:pops.works_manahet__2841ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'238 bytes
First seen:2020-06-16 23:26:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9s:rpwYGRb+lbUqcl2Ur25Hs5Iq
Threatray 5'002 similar samples on MalwareBazaar
TLSH 4EB449C6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11960/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-16 23:38:01 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
0b5f544aee9ef5a7bcbdcfddcc59088d75241dc7b55bf4294441521702721022
TrickBot
228afedc197071557d8a1acee8462cc55c9148c8af0b06b8859451c5d843598c
TrickBot
31aa48f9ad497574a3586314f7f4eeca5318e849ec4eda53c7f776b7800c4e96
TrickBot
44d26244ec4af6f122409099bdddd9f8829874b5983b4afc9c4583419f8c5317
TrickBot
845068929c358835b76f7c81192e5c8b1669a52055f7d5e6464c85b6cc8a3f0b
TrickBot
a0ce5baaf1595eddf58a81d9593b0d4dac12f6eb09e9c7b6ce8266fa3d430927
TrickBot
be25af0f64b55a10610109888edee51e4d99751adffb8e84135aa2e7b6621c56
TrickBot
ce69760f6b3fb246558e4ff4fa3312af9d7c01460b7ea2dec7c0ef1c0f5dec50
TrickBot
cfb9760bf161f34f1f6922babe8c09dd9477b34b832de1abc3b10dd60f346c1e
TrickBot
d1f2a29b27e6e45ae3c7d4fff464cbf832c4348fcb37ce931f4edab56512fd4c
TrickBot
+ 4'992 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-31fyaej63s/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/11960/

Comments