MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a3efb5cb22ae7f3b8dcd03ab2da67288034b22729af4b1e3b23c2c9454d7636. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	7a3efb5cb22ae7f3b8dcd03ab2da67288034b22729af4b1e3b23c2c9454d7636
SHA3-384 hash:	f2502e79daadd5ebf6b3ac85102abcca8ad1a1c4fe33c8b18fa1c0a2558b9536d391d8bb452672b6ff21c03c87fa1d19
SHA1 hash:	dfcf94bf79a74158b39315ebc9bf8876e4893c2b
MD5 hash:	5dd08a30d4fa6ede01e9ae00655ffb30
humanhash:	kansas-oven-west-hawaii
File name:	SecuriteInfo.com.Trojan.Malware.300983.susgen.1919
Download:	download sample
File size:	593'984 bytes
First seen:	2020-08-25 23:18:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d68a7f00713f10a63b1c459a67eeae6e (16 x BazaLoader)
ssdeep	6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Threatray	126 similar samples on MalwareBazaar
TLSH	DBC49D52F7E449F5D073913ECAA3878AEA72B858473047CB025497192F3B7E19A3E721
Reporter	SecuriteInfoCom

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50772/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Transferring files using the Background Intelligent Transfer Service (BITS)

DNS request

Sending a custom TCP request

Sending a UDP request

Launching the default Windows debugger (dwwin.exe)

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/450405

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Keylogger Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7a3efb5cb22ae7f3b8dcd03ab2da67288034b22729af4b1e3b23c2c9454d7636/

Threat name:

Win64.Trojan.TrickBot

Status:

Malicious

First seen:

2020-08-25 23:20:08 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Verdict:

malicious

3db0ffdac23433607c69a18ed4a3371a4b174672ca5d6424f7b50efa6f29d969

86cebe269c6969250ee0b71d4a510cd7b7a34edad41bfb616504a5ecfff751ef

8c671a4dec5556b8afc0841320b404d422067c4b034f563f5af29ff5837cf570

93efb12bbed83f964130d8e1434ff3ba789a7c506693bcac9194fe09b35aeccf

aa1be103378c35cac611142349b9d6d81eced0713cd7cba343fa93648494102e

b49cea65793b29d1e91ec0ee85e5cc654682b4f974eef57063543ac20f1a5c81

bb402c82a60302c8a43809370bab8e233e4e29cb17181a13b2c3d57228e6c3e7

f3a238c27030d8a14168beb15009f192a33e89010197220561d9e68376ce5d0c

ff7dae4538d435d3081fdd58eee582c1194bea7d22b96d781086689b8e21a9f9

+ 116 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/200825-w6v53xy2va/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of SetThreadContext

Blacklisted process makes network request

Suspicious use of NtCreateProcessExOtherParentProcess

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7a3efb5cb22ae7f3b8dcd03ab2da67288034b22729af4b1e3b23c2c9454d7636

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_uroburos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator