MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e583f2351c0526cda822acb46434614ebd35e0b51ca9934173c28ed382552ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e583f2351c0526cda822acb46434614ebd35e0b51ca9934173c28ed382552ce
SHA3-384 hash: 730eac630c50a85c5ddbd7165c55a0e3f1bde6967832b2aee0e93ba8febff6150e404d9e0eb605085158deba4dffb8a5
SHA1 hash: be807d17a249ab8a37f3ce3f88cc4d8737be5efe
MD5 hash: f034a55a2d40dd511f13efcf714406ca
humanhash: lake-video-hawaii-kansas
File name:SecuriteInfo.com.Generic.mg.f034a55a2d40dd51.11695
Download: download sample
Signature TrickBot
Create hunting rule
File size:639'208 bytes
First seen:2020-03-19 22:42:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5b13da0110ad09b8405416e16328d5df (2 x TrickBot)
ssdeep 12288:CWqwSRyqOKNfqC4bHQ5cmUcuSFzRMWCvEHk08AqDha:OyqOUiC4bHJmJu8zJkqq
Threatray 113 similar samples on MalwareBazaar
TLSH 86D49E3336DBC6BBD1B201B95D4643B422E67CB17E2C426376E12E0D8A351B2497A3DD
Reporter SecuriteInfoCom
Tags:TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
100
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.f034a55a2d40dd51.11695.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Trickbot
Create hunting rule
Status:
Malicious
First seen:
2020-03-20 00:27:57 UTC
File Type:
PE (Exe)
Extracted files:
37
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzmd6i2rybjgzwucflfumq2gctv5gxqlkhfjsnaxhquo2obfklha._file
Verdict:
malicious
Label(s):
emotet
Create hunting rule
Similar samples:
098fae655e3c393db5aeacc97ef1e147a187dacfc78de3735b1fb22ba05cbc0e
TrickBot
181a79a35af190ce05e5bac09e23d8670c247db0b55f465ff2af8c834e984ed6
TrickBot
3700f2c5fe27c80e41984b2a55f236655a09f0781c05b265bccb26165318d78a
TrickBot
51c8e10c77c9f131b207be4bff0e37a09cf4f24b3b941416ae22bc438d1730c4
TrickBot
6a03670ab278379848cd3e785dea4c20419f993bb48b4f52d953350af6e44468
TrickBot
7cfa85e9c1bed641e7377f9d9730869a232979754f06667a365f50644b83035b
TrickBot
8deba9fb53096d6ea5e2090b662244293829096eee03d06108deb15e496a807e
TrickBot
cd06cd467ba6c7f253a850450691e8b996f955b69f6fa9ff231f52bfe95fbd18
TrickBot
d697aab77bad680016a127ceabe470e80a6f979962e2e02d51365856a633639e
TrickBot
daa11fdb959bb255dbc1df14a8d59a8e61217e242d2cd4c56423a68ef938131a
TrickBot
+ 103 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9e583f2351c0526cda822acb46434614ebd35e0b51ca9934173c28ed382552ce

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe 9e583f2351c0526cda822acb46434614ebd35e0b51ca9934173c28ed382552ce

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/327169/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoFreeUnusedLibraries
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetVolumeInformationA
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::GetFileAttributesA
KERNEL32.dll::FindFirstFileA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegQueryValueA
ADVAPI32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments