MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c9434a3b15609527d6a986d747aa13a90786d1e86fddd864cbfbaf2f01bfe1fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 11
| SHA256 hash: | c9434a3b15609527d6a986d747aa13a90786d1e86fddd864cbfbaf2f01bfe1fb |
|---|---|
| SHA3-384 hash: | 6df956edfef570f2abab8df57e85a22a52696c2f3a856afe4825fdccf600d7e9530a83eca0cc3c2c1556c2d4581d213a |
| SHA1 hash: | 084abcb69b8a1db256b363746ce6ef6f7cd547d8 |
| MD5 hash: | 0d57d2bef1296be62a3e791bfad33bcd |
| humanhash: | eighteen-lima-queen-berlin |
| File name: | c9434a3b15609527d6a986d747aa13a90786d1e86fddd864cbfbaf2f01bfe1fb |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 267'693 bytes |
| First seen: | 2022-08-12 07:00:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 9402b48d966c911f0785b076b349b5ef (3 x TrickBot, 1 x Plugx, 1 x DBatLoader) |
| ssdeep | 6144:DcWMJJhqryYP/daqQ1rysMItKkEn5+zP2/t24UYyeztON83bJd:DczJJhqrVPlerZMVk0+zP2V24Ugukbj |
| Threatray | 85 similar samples on MalwareBazaar |
| TLSH | T17344DF1735E2C0BBD4526930EA286EF891B7BD79F679640BEB833E1FFA309405451623 |
| TrID | 80.5% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 9.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 3.1% (.EXE) Win64 Executable (generic) (10523/12/4) 1.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.5% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| dhash icon | 45453333d4d4552b (3 x TrickBot) |
| Reporter |  JAMESWT_WT |
| Tags: | exe news-nhknews-hk paloaltonetworks thailand TrickBot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
669
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
bookworm_kasp.exe
Verdict:
Malicious activity
Analysis date:
2020-05-20 12:48:28 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Delayed reading of the file
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Creating a service
Launching a service
Launching a process
DNS request
Reading critical registry keys
Sending a custom TCP request
Enabling autorun for a service
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
bookworm greyware korplug overlay packed plugx shell32.dll
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
UACMe
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Deletes itself after installation
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after checking mutex)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected UACMe UAC Bypass tool
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Surge
Status:
Malicious
First seen:
2015-08-07 01:56:40 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
31 of 41 (75.61%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 75 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
2e325325fad27e1ed24e4955556582e4c8ba9904f2001b91017663b011ac0486
MD5 hash:
fd030c23090f63570535f22baca5fb3f
SHA1 hash:
f84e9dbac89e3eaecd210b8e1ece5ae0d366356d
SH256 hash:
cc4138413b6214c0eeecc919571dbacc37daf9c88af8872d0e593b9a0fb94efc
MD5 hash:
5b8dad15ddbebd5720d7839176fe068d
SHA1 hash:
e36ac2451952d2b550119682a729b9192059ad59
SH256 hash:
928a2ef0ac4c097d0e44cf2438688406deb2d4c9b96d2df38faa7aa848b37cb4
MD5 hash:
35527e04a237572eea29b4523cadc27a
SHA1 hash:
db2bff7033aebce15ca15547a546c115c1eb1059
SH256 hash:
f041cbea986a4ba28e342a1374682c7b17026c81aa275e306df5121a704804cf
MD5 hash:
1b05b0859462032bd081480634374075
SHA1 hash:
c05ba003187d5b8da2a149a954e0f22954a21336
SH256 hash:
b041b97d5df32f08d0726fa5c8ee6b55185a4886266862f165ecf86d543f9c39
MD5 hash:
385654b8a8696bfb6e4d4b8a695a6ea0
SHA1 hash:
bf36380ba0dce85e84200be5a09c6b6b81d7d7c5
SH256 hash:
58eb95b43ce0d0764cd84ed6c6335a4e2f370fc2ea3ebfa4ea68888d21b69c0d
MD5 hash:
5d55c2aab9c424bf933fa0608489d45e
SHA1 hash:
b2e6bd9138b111b9dc1277d7e2f8fa5632e06086
SH256 hash:
5dc3f1bd3ca48a13aaf019215072ab58eaad351ec366af89df5b044f820f4122
MD5 hash:
7cdfc8c8e6243da058f698464d93f036
SHA1 hash:
b1af218a6d92de944b88cd40d660ec3351488bf9
SH256 hash:
4897a9bb6eb0bfc52443526021c72692d4f12b09c93569544e6884f054ea1dba
MD5 hash:
7475b3b0963addd590257bac3395969a
SHA1 hash:
99808006a4abade4aec8f9f27ebed9d3fdc8693f
SH256 hash:
fea63c057424e52cef874817ba3d986d123af457a2bee45d8b66569786dcac4c
MD5 hash:
0e631c0210030389a61213843ac728fd
SHA1 hash:
599a2ad5b67dbb11ac60ab1439e77f90631001fd
SH256 hash:
a7063b004d9ec4bb684cd3b59fde844c5888a6e46416751a0cfac3da232f0e90
MD5 hash:
513d8e143681aaa7831c1ece121bb800
SHA1 hash:
adcd58fec2d8d40d7ca966fee7821225e00ce109
SH256 hash:
997af2d6e808cfc44abe18ce7db138b49c71c948f26eb9c2a6c05bee9d0e2b78
MD5 hash:
23434406fd4f0d31eafd4d10afec6556
SHA1 hash:
ee254ea83e5209a8a577792bde54d9699a49211f
SH256 hash:
bda084085d7b793859e843a9f94bcb8beb163afc4e5e89bd13af5d5eafefe52a
MD5 hash:
3033a42281f75506014046dcda16edd6
SHA1 hash:
cbfd9789e71736b4010808a5855b7c4c06065e02
SH256 hash:
7d5a148d43e2e913bd67a1032d389fb0253ee59bcad04d74a7110c2e1733f677
MD5 hash:
c516cd601f7dd4b7cf9d6bd021189ac8
SHA1 hash:
5164b3f52c74d986e4ca0e9363cede64abe207cf
SH256 hash:
e7102966c6fc8bb3f70350dd79c53fdbf6d011586a70418449eb40d451d5501f
MD5 hash:
7221953f3fc67d85d3f09626b31ea9f9
SHA1 hash:
58bebd8baa5ce42420d6ec84b092ad72f79b826b
SH256 hash:
e0d9363075f597e9f7b0eadec7ce588239ee439e8b9253f512df34ad1185ce6f
MD5 hash:
dc76edc64f6bc6788bf755c616d0a638
SHA1 hash:
4d5b0a2dcc4f1e2e4f7fe20eadb503ebdcd6daa4
SH256 hash:
c9434a3b15609527d6a986d747aa13a90786d1e86fddd864cbfbaf2f01bfe1fb
MD5 hash:
0d57d2bef1296be62a3e791bfad33bcd
SHA1 hash:
084abcb69b8a1db256b363746ce6ef6f7cd547d8
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.