MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968
SHA3-384 hash: 5d6b2256d68f06b65cf4f897064bb174ac7f57d430876bfdad129e6e323eb38a863378991a934f63f11905ab2eaac768
SHA1 hash: 6e59ff5d2f88afb7781064feaac37ae060c46178
MD5 hash: cc9d6fe92b4a055cd61a80b419943830
humanhash: cup-quebec-chicken-alpha
File name:cc9d6fe92b4a055cd61a80b419943830
Download: download sample
Signature TrickBot
Create hunting rule
File size:1'980'928 bytes
First seen:2021-11-22 15:36:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d31639bc44b992226d49e6ecf1a2a248 (5 x TrickBot)
ssdeep 49152:SBQhCnUUbPhzn++Z3vrOzYN/z8PcrpQiX:
Threatray 1'139 similar samples on MalwareBazaar
TLSH T1A995C190338872E7F68BE53B5330983AB26639F57A6790C89BD37F4D586EE404F24941
File icon (PE):PE icon
dhash icon 787c78fa87f7e6c4 (18 x Gh0stRAT, 11 x Pikabot, 9 x ManusCrypt)
Reporter zbetcheckin
Tags:32 exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
874
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cc9d6fe92b4a055cd61a80b419943830
Verdict:
Malicious activity
Analysis date:
2021-11-22 18:50:10 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/36fd2492-b342-4bc5-aacd-3d498fbf18af

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.17021.15207.31607.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Creating a file in the %temp% directory
DNS request
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm wacatac
Link:
https://www.filescan.io/uploads/619bb92094a88037d2fe9ad5/reports/d5c1c5c6-8172-410e-92dc-56f88f2cf6f7/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dd0cce5e-172e-49b9-8adf-a0f5da06e41e
Result
Threat name:
TrickBot
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/893973
Signature
Allocates memory in foreign processes
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Trickbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 526448 Sample: RjNFreplB8 Startdate: 22/11/2021 Architecture: WINDOWS Score: 64 13 Multi AV Scanner detection for submitted file 2->13 15 Yara detected Trickbot 2->15 6 RjNFreplB8.exe 1 2->6         started        process3 signatures4 17 Writes to foreign memory regions 6->17 19 Allocates memory in foreign processes 6->19 9 wermgr.exe 6->9         started        11 cmd.exe 6->11         started        process5
Detection:
trickbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968/
Threat name:
Win32.Infostealer.Trickster
Create hunting rule
Status:
Malicious
First seen:
2021-11-22 15:37:19 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
25 of 45 (55.56%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
1455e78e95b8e3b9df5eb8d8d1703018c927694c6269e01f1b846abdfa054b82
TrickBot
2a039fd90e9150cf1caacb66326d0a3aae6f050c6d0a20e0adbaa2a2e3025450
TrickBot
64c5309cb3d2245b3dfadf321296c8a7cf86c9ae33764e09a41932c3c4fc823e
TrickBot
6db7642e42467842b97947426d78418e58c1e0b25f125ce0faa8bfa6436a70b2
TrickBot
784b92117e7bf582e7c9d5d9691b228f048ab1d68bf62fa5d730b790d196565e
TrickBot
968a796e04e6cf1ee9bcfb89923369373056790e9d37afaaeeacbb427f5a891f
TrickBot
9890dddc8087d395c5eab7410880b35d3e790d11ab08f2b4a039818e814f21ed
TrickBot
b6ec985f433a33d1c9c38ad7ab288bc2be516075391b67a64cc36f3f668fb1c3
TrickBot
e1b7ffcc831b6b0ef56e665e5f0f8daee789b9426e8dce21e44fbbe9518acbdb
TrickBot
f8cdd0190b5b1bc3a441e8298cdedec9f09bca6ff99ec0b461d7730985ffb78b
TrickBot
+ 1'129 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/211122-s2gsjsahd6/
Unpacked files
SH256 hash:
e177d899ad1fe93863e30a44fe7adcdbe6cbde5594c9ffe63115592fb2a39de0
MD5 hash:
4610eeac2606fb87588f945a68575a6b
SHA1 hash:
bfe3f6d3fb86a6538b3364e966abafb647eed021
Detections:
win_trickbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7a2abf3c-d94f-46a8-81d9-a8146772b15e/
Parent samples :
2a039fd90e9150cf1caacb66326d0a3aae6f050c6d0a20e0adbaa2a2e3025450
d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968
0d8f71039695b040b07f1d5781b4ef5e50b318532eb1139b5de954f13c6751ae
e177d899ad1fe93863e30a44fe7adcdbe6cbde5594c9ffe63115592fb2a39de0
c988a65d39f617c531454c2f15971c0a769d42ac84bea0a7a3bd89394ba3e654
355d4c4c8eabcf15161ac4754c6a20fd1945c91a90f88e90de1d2ba2ac1545de
SH256 hash:
caa984b56368d0a9f66cd6b0c0af05764009c6f05eaeabc5d8c05cfeb1ddb926
MD5 hash:
3f9198b8ed6f6f1238de1d71a23e5782
SHA1 hash:
7324fa3dac5f4f7c7880f220c2e04f3f099e6381
Link:
https://www.unpac.me/results/7a2abf3c-d94f-46a8-81d9-a8146772b15e/
SH256 hash:
d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968
MD5 hash:
cc9d6fe92b4a055cd61a80b419943830
SHA1 hash:
6e59ff5d2f88afb7781064feaac37ae060c46178
Link:
https://www.unpac.me/results/7a2abf3c-d94f-46a8-81d9-a8146772b15e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d8ec9f0a62bf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

TrickBot

Executable exe d8ec9f0a62bf5507bee6eaa6fa254937b65a0e27fee0906d715aa7fefa4da968

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/208256/

Comments


Avatar
zbet commented on 2021-11-22 15:36:30 UTC

url : hxxp://45.42.201.16/images/robert.png