MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84f007e1e974a8305c3406d47d3430812f1805974f582cf2230bdf03f2c33269. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 84f007e1e974a8305c3406d47d3430812f1805974f582cf2230bdf03f2c33269
SHA3-384 hash: c1581ad7029952ba61242175080ead5d316332a6199de0eb3ff77ee8e1b0ae8a1e8ce5b3edcbe3d65627af7f1acd03b6
SHA1 hash: 934f9a669dfa0e1eb28c44d4efebe3af23c9ba70
MD5 hash: 9d79b08deadcde5b3b913ee75d3fff8d
humanhash: nebraska-fanta-juliet-north
File name:tar7ce.exe
Download: download sample
Signature TrickBot
Create hunting rule
File size:524'288 bytes
First seen:2020-10-21 00:17:47 UTC
Last seen:2020-10-21 00:26:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash de4caa6fc9801bac780049d90a73963a (1 x TrickBot)
ssdeep 12288:pU6GTTTux+Ddn9iFn9dLn9Brs8nBX5IIpIMAzeKYiHJqETGcYGt46A:y6pRdIjAWJSctOL
Threatray 3'727 similar samples on MalwareBazaar
TLSH ECB46C129BF82105F2F76FF01D7666A82F36BC526835DD0F1244B94E1973A42A9E133B
Reporter malware_traffic
Tags:exe mor134 TrickBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/73826/
Detection(s):
SecuriteInfo.com.Artemis9D79B08DEADC.30844.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Threat name:
Trickbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/502988
Signature
Allocates memory in foreign processes
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/84f007e1e974a8305c3406d47d3430812f1805974f582cf2230bdf03f2c33269/
Threat name:
Win32.Spyware.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 17:16:32 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
26 of 28 (92.86%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qtyapypjosudaxbua3kh2nbqqexrqbmxj5mcz4rdbppqh4wdgjuq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
52ead54da4a0ff739478ee507e1eaecff307b00e8a5c8aa6758614f8c56558ce
TrickBot
64e99051b9cb45a384b9ed588cf3d5a8734c29ec44da0a99b0f38414652bef7c
TrickBot
6961e320f0c3a96fb44315f56099b1af9f7c8f56f66eed9522782b17f266f7c2
TrickBot
6ed8baafe6922ca166f88a03248e937ce53a63c5260c3c8942af8a10e5a032a4
TrickBot
731f9c60c47914b2dcc22536d709f5bf0aae0176c27bde61e5428e9a1afdc602
TrickBot
8359f916d60f95ffa8f84718bfede02501f601f8aa72d21c00a8d8ccd4126898
TrickBot
c717553553348cd9f03f66b0c5c55fd16068c3f9856f757f618222968ea565d7
TrickBot
d98f26da9dd79c4a39085174946c13d4d0d1655bed138a2273ba0b92eca640ce
TrickBot
dbf9b476ff7e338b1c752912268c4223264b57d13dc1f76adfdba7857e2fab44
TrickBot
fa15dce4279dfec6e787cf1cd312ce2e99c7a73e9886d87154d1de91d29a62ec
TrickBot
+ 3'717 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201021-8vz11hc4xx/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
28e1198ad107a4288afcef483fa769c00b3329b4ac83cdaef838a2a6fa13f6ce
MD5 hash:
cdcfbb7d55e6c8c37f1b5af35a1905ee
SHA1 hash:
096a4e7b2f7e79a2618f58715edf6b2963e68111
Link:
https://www.unpac.me/results/9715439f-b521-40c0-bfe4-33f10cfe0787/
SH256 hash:
f1659716e8e258c9e40fd271e243face7b805fde5a90daa904ffd5af705725a5
MD5 hash:
caae00512228eda6050bf80810501c07
SHA1 hash:
1c1c2b90d13ad2f762883240b2372e82de0e99c5
Detections:
win_trickbot_a4
Create hunting rule
win_trickbot_g6
Create hunting rule
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/9715439f-b521-40c0-bfe4-33f10cfe0787/
SH256 hash:
84f007e1e974a8305c3406d47d3430812f1805974f582cf2230bdf03f2c33269
MD5 hash:
9d79b08deadcde5b3b913ee75d3fff8d
SHA1 hash:
934f9a669dfa0e1eb28c44d4efebe3af23c9ba70
Link:
https://www.unpac.me/results/9715439f-b521-40c0-bfe4-33f10cfe0787/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_trickbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/73826/

Comments