MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93efb12bbed83f964130d8e1434ff3ba789a7c506693bcac9194fe09b35aeccf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	93efb12bbed83f964130d8e1434ff3ba789a7c506693bcac9194fe09b35aeccf
SHA3-384 hash:	9246a4b3f5d27f34c50c218c8beba0aa996457eac1db43681d833aaf01964c5837bef11072c3d56892b6dfa13993a5bb
SHA1 hash:	fcb234907ae4c95bc53ad6e0b28b35d994a57d6e
MD5 hash:	e384d6e415b246f451fe1e5479f783f3
humanhash:	cold-august-comet-east
File name:	SecuriteInfo.com.Trojan.Malware.300983.susgen.19268
Download:	download sample
File size:	594'337 bytes
First seen:	2020-08-25 23:18:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d68a7f00713f10a63b1c459a67eeae6e (16 x BazaLoader)
ssdeep	6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Threatray	126 similar samples on MalwareBazaar
TLSH	43C49D52F7E449F5D073913ECAA3878AEA72B858473047CB025497192F3B7E19A3E721
Reporter	SecuriteInfoCom

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50773/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Transferring files using the Background Intelligent Transfer Service (BITS)

DNS request

Sending a custom TCP request

Sending a UDP request

Forced shutdown of a system process

Unauthorized injection to a system process

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/450434

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Keylogger Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/93efb12bbed83f964130d8e1434ff3ba789a7c506693bcac9194fe09b35aeccf/

Threat name:

Win64.Trojan.TrickBot

Status:

Malicious

First seen:

2020-08-25 23:20:10 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Verdict:

malicious

3db0ffdac23433607c69a18ed4a3371a4b174672ca5d6424f7b50efa6f29d969

7a3efb5cb22ae7f3b8dcd03ab2da67288034b22729af4b1e3b23c2c9454d7636

86cebe269c6969250ee0b71d4a510cd7b7a34edad41bfb616504a5ecfff751ef

8c671a4dec5556b8afc0841320b404d422067c4b034f563f5af29ff5837cf570

aa1be103378c35cac611142349b9d6d81eced0713cd7cba343fa93648494102e

b49cea65793b29d1e91ec0ee85e5cc654682b4f974eef57063543ac20f1a5c81

bb402c82a60302c8a43809370bab8e233e4e29cb17181a13b2c3d57228e6c3e7

f3a238c27030d8a14168beb15009f192a33e89010197220561d9e68376ce5d0c

ff7dae4538d435d3081fdd58eee582c1194bea7d22b96d781086689b8e21a9f9

+ 116 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/200825-9zfx8ft5zj/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blacklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/93efb12bbed83f964130d8e1434ff3ba789a7c506693bcac9194fe09b35aeccf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_uroburos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator