MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c304a479235303c0725cf36845313692e5d9a2d9f7db7e77de3c0d75229c5e0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c304a479235303c0725cf36845313692e5d9a2d9f7db7e77de3c0d75229c5e0f
SHA3-384 hash: 56ff1e7e3725913b6349d44cbc839623b3ee4b35c73e61ab8e77c098724c6141d5d09369eacc6b94ecce940642ffca07
SHA1 hash: bdece9226cc519f22c0204fbc80b5d468c5d1f10
MD5 hash: 058b418471ede3f1d638271a37e62651
humanhash: oven-ink-illinois-lake
File name:c304a479235303c0725cf36845313692e5d9a2d9f7db7e77de3c0d75229c5e0f
Download: download sample
Signature TrickBot
Create hunting rule
File size:252'937 bytes
First seen:2020-06-03 09:20:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 515fbc70346f5d298b5420fd27f1ea5b (4 x TrickBot, 1 x GandCrab)
ssdeep 3072:6e/3l1glxNGX0+tl0BNsPmmWpOTgfgDOOK+74ArCjZ/NHkciAHaLiq7:6evEDGk+tOWmTYD/gEY/EcHKiw
Threatray 82 similar samples on MalwareBazaar
TLSH 5434D01775D3D431E43313388E0E9B428572BCB41F22F68F5A994D9F2B762D0C5AB2A6
Reporter raashidbhatt
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Gandcrab-6552923-4
Create hunting rule

Win.Packer.Crypter-6539596-1
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Gandcrab
Create hunting rule
Status:
Malicious
First seen:
2020-06-03 11:06:00 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
044e1fb5fc6ecd58ea3ad131054c27c448312974086e205241768b61f165db3c
TrickBot
06dcc85fb193c1f6b649359debd55346499a50b72bf475f50172633d64cf1f53
TrickBot
08ef36cec235b20cd791cfa4c8a49af3060d0f480c6fa6b0d91bd420b9b6f597
TrickBot
0d4468410b46f3002718b14ed94ae48269281674b61b7678167206924ef29eb3
TrickBot
2d5e78d630a68f6d235c6bd845432bba8a213e2b03a3b79b0cd9b6273b0c284c
TrickBot
6cca3e66e1ca37e84205789ff6bce14ba137da7dc166e606cf10b9b198e120f3
TrickBot
7f25e53c8b2156c33e343519cb3a5e1c06a7bdea986695e08e5cdfae4af3fd49
TrickBot
84acc2460064e9c30208185cb7db162cd05bf5caa091c5586ffc9a479ee5f884
TrickBot
9316d6daaf6e34ab8a0cb9900a9e6d2d24a417e41c67335b0333590182909324
TrickBot
c8e3cf9cd054a388848d36f1dcf9c9e6efa070d973d9d009e2572ad573477c0b
TrickBot
+ 72 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-mea52d1w8a/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Adds Run key to start application
Enumerates connected drives
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments