MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84c5a1eaefc698018941f9566fd6b80d87ce31827303788401a13a7dc98d8f22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84c5a1eaefc698018941f9566fd6b80d87ce31827303788401a13a7dc98d8f22
SHA3-384 hash: b609ff4d8635cdfc203b39e38faebf9453a5d0e3b47e13d9a9936962971f83ca12d173584440f8521face4f3ee0fc252
SHA1 hash: ea30cad0fb6f014ea3e8a2b00a0295e883603172
MD5 hash: a287b919ecb76f13a95ce51f9c416b29
humanhash: robert-johnny-lamp-autumn
File name:99443fvasea.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:373'721 bytes
First seen:2020-04-22 06:59:56 UTC
Last seen:2020-04-22 07:13:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0885b2b2b5829577912d5197330fc416 (300 x TrickBot)
ssdeep 6144:WBOO856a60r+UogID97/IXjBE7SL+MEXxtSbsP6AN/:WBOO3VKID90TBEhx4O6a/
Threatray 2'968 similar samples on MalwareBazaar
TLSH 7A84CF013CCFCCF2E4150131C8868BD49679BC2A3E5AD597FBB42A5CDAB5381D92B26D
Reporter JoulK
Tags:TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

PUA.Win.Downloader.Firseria-6804617-0
Create hunting rule

SecuriteInfo.com.Trojan.Packed.140.11914.9480.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-19 04:52:17 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
27 of 31 (87.10%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qtc2d2xpy2madckb7flg7vvybwd44mmcombxrbabue5h3smnr4ra._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
03703d872a8c3b479d97570406f069fe78d29722bfb585fbc298708ece8f868b
TrickBot
0d62ddbeb425b5b4715637866e4c4e6736909b15ba6360f0ecc68f8ae5da689f
TrickBot
27c3f84dd3101c302afb523ee2c5b728c1fc34cfb8430c314d1f2df5ed79c28c
TrickBot
85f98350c29aa63d0d5c41458f224536c09c1f1c8ab57a41ec5cd34bf58fa56c
TrickBot
9977722c62d428adb75fb5103434958e72c532e70db0338b7caa017d04bc223a
TrickBot
aa8c5489d66d4c8281df1590641f32468dfa0429ff90d1183306f0a81b9915bb
TrickBot
babaa5f246f5b57fc0a02d081f9058990b3069f2bfe683e98b663a86f4b8752d
TrickBot
ca551d1b3c88469dd80ee4010e87c6f2f7953219b827ae09856325c3386dfd0e
TrickBot
d3b0de5c75423bb0000ec0713e245a39d70a76e3e722bd5be161aaee271a4b95
TrickBot
d48a161d94315e34c7f8cc55c25e5b68de363ca49b31a35a8f4af3f83f8a1228
TrickBot
+ 2'958 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 84c5a1eaefc698018941f9566fd6b80d87ce31827303788401a13a7dc98d8f22

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/345913/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileA
KERNEL32.dll::FindFirstFileA
KERNEL32.dll::GetTempFileNameA

Comments