🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e8c547fcc86e26b973e4c974da8ee2c4cfe84846e2cdfcd7f265929d27602f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e8c547fcc86e26b973e4c974da8ee2c4cfe84846e2cdfcd7f265929d27602f9
SHA3-384 hash: c8152131d11565c08615b267a2b103c2a3e3a4de03c4068a1a477c41af611976e129218f3699d5ebfd37b56e5ff06396
SHA1 hash: ac0724c724f8d6e2a54b41b86d99aa189e40dc81
MD5 hash: 17492f7b9906b807cffd30e8a0edd993
humanhash: bravo-golf-twelve-lamp
File name:bnuethogt.bin
Download: download sample
Signature TrickBot
Create hunting rule
File size:550'424 bytes
First seen:2022-05-25 12:44:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 46111b1241c22aa3ede6b4176531c30a (2 x TrickBot)
ssdeep 12288:QyeWT96x+MN2N4Bou8Bw1bFswwGFGvyLOE8uQnUK5bA:QyeAEwN4BuYFswwsGz1uFCc
Threatray 6 similar samples on MalwareBazaar
TLSH T10AC4022076E089B2D46D423688A7EF4A576BAE314F6645C7FBDC038B0E347C06A7751E
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 72f16979787a726c (1 x TrickBot)
Reporter KdssSupport
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
880
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
trickbot
Create hunting rule
ID:
1
File name:
tr2.exe
Verdict:
Malicious activity
Analysis date:
2022-02-08 16:29:44 UTC
Tags:
trickbot
Link:
https://app.any.run/tasks/dc215b64-d0ca-40c7-bae1-caae16066394

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/274506/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Changing a file
Running batch commands
Launching a process
Creating a file in the %AppData% subdirectories
Using the Windows Management Instrumentation requests
Blocking the Windows Defender launch
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/20342/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware icedid overlay shell32.dll trickbot zpevdo
Link:
https://www.filescan.io/uploads/628e250e3ec49f83a6ca8584/reports/822bfa6b-be36-42a9-bf71-7bd8d890994a/overview
Malware family:
TrickBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6d1da5a8-c1d6-4d72-83b0-0f931bf2eab3
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
bank.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/675850
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
Contains functionality to inject threads in other processes
Detected Trickbot Trojan
Disable Windows Defender real time protection (registry)
Disables Windows Defender (via service or powershell)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 386863 Sample: #U0435#U0435#U0415#U0430#U0... Startdate: 14/04/2021 Architecture: WINDOWS Score: 100 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for dropped file 2->50 52 Antivirus / Scanner detection for submitted sample 2->52 54 2 other signatures 2->54 8 #U0435#U0435#U0415#U0430#U0410#U0445#U0445#U0412#U041e#U0435#U0415#U0430#U043e.exe 7 2->8         started        process3 file4 40 C:\ProgramData\?????????????.exe, PE32 8->40 dropped 42 C:\...\?????????????.exe:Zone.Identifier, ASCII 8->42 dropped 11 ?????????????.exe 1 24 8->11         started        process5 signatures6 56 Antivirus detection for dropped file 11->56 58 Multi AV Scanner detection for dropped file 11->58 60 Detected Trickbot Trojan 11->60 62 5 other signatures 11->62 14 svchost.exe 11->14         started        18 cmd.exe 1 11->18         started        20 cmd.exe 1 11->20         started        22 10 other processes 11->22 process7 file8 44 C:\Users\user\AppData\...\?????????????.exe, PE32 14->44 dropped 46 C:\...\?????????????.exe:Zone.Identifier, ASCII 14->46 dropped 64 Benign windows process drops PE files 14->64 66 Contains functionality to inject threads in other processes 14->66 68 Detected Trickbot Trojan 18->68 70 Disables Windows Defender (via service or powershell) 18->70 24 powershell.exe 24 18->24         started        26 conhost.exe 18->26         started        28 powershell.exe 22 20->28         started        30 conhost.exe 20->30         started        32 conhost.exe 22->32         started        34 conhost.exe 22->34         started        36 conhost.exe 22->36         started        38 17 other processes 22->38 signatures9 process10
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/7e8c547fcc86e26b973e4c974da8ee2c4cfe84846e2cdfcd7f265929d27602f9/
Threat name:
Win32.Trojan.DllCheck
Create hunting rule
Status:
Malicious
First seen:
2019-07-19 16:52:42 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
26 of 27 (96.30%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
39ca86089dcbdbce612bb989dda90c7fd5ab244f7b4b03b28e16124365ba858a
TrickBot
5a981863a8a716fe0efd362e6354876d27f24ad1201f14f13f4f61ae3e24452c
TrickBot
704ce7961d8b7ad909c8664a548b8c9914bd23093458e26539298fee1aa2fc61
TrickBot
82578a7bd6394c72cd0d38f131d895813867c8c90d8128489207ac6186af5ae1
TrickBot
e33efffc8425fb12d4d9f8c18a066d7f80d328cf7a74a235acf175d587146e9c
TrickBot
eec13ba57b49bac069e70ccd6922df9e5ea34f9e9787aa686e6bf327a10dcf8b
TrickBot
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan
Link:
https://tria.ge/reports/220525-py2rrsaed5/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Stops running service(s)
Modifies Windows Defender Real-time Protection settings
Unpacked files
SH256 hash:
c3f53089ed25572ce22bdcc48ff8ffa008018f11e6b7ae0faa06d3d6b365d68c
MD5 hash:
78face6532ea097b73d507f3e06bbcac
SHA1 hash:
7bb03b4a49477e3972cafe3609d42a912ef6c770
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g5
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/706b5c12-ea95-4af0-9454-d11b3a77489f/
SH256 hash:
51ca4cb650acfa7e26244a849c144d5f5d9a5a5e08ea38509e1c6292f23b4d38
MD5 hash:
9df0858b1efaf1d9008f7a5fb350fe1a
SHA1 hash:
32cf2b401ccb5e017908b1687042907126f6b0fa
Link:
https://www.unpac.me/results/706b5c12-ea95-4af0-9454-d11b3a77489f/
SH256 hash:
7e8c547fcc86e26b973e4c974da8ee2c4cfe84846e2cdfcd7f265929d27602f9
MD5 hash:
17492f7b9906b807cffd30e8a0edd993
SHA1 hash:
ac0724c724f8d6e2a54b41b86d99aa189e40dc81
Link:
https://www.unpac.me/results/706b5c12-ea95-4af0-9454-d11b3a77489f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7e8c547fcc86/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e8c547fcc86e26b973e4c974da8ee2c4cfe84846e2cdfcd7f265929d27602f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/274506/

Comments