MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e46a4a03bb7fba8eca2edd7848fab82ba434ab57207f88ee3e0c1d9407471314. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e46a4a03bb7fba8eca2edd7848fab82ba434ab57207f88ee3e0c1d9407471314
SHA3-384 hash: 4c5dec8430f40dc815c4d1939d15d63bb212316295407aea21f50f562cbb9739f523e0baf9af2dac536ba85db341cc26
SHA1 hash: 7c478f23b8552d84bccb7a5e75ec50574c6e06d3
MD5 hash: 3f7ab54f363980ac39d45ad4cb1d7614
humanhash: earth-hydrogen-golf-yankee
File name:pops.works_manahet__314ab4nu59ok.exe.malw
Download: download sample
Signature TrickBot
Create hunting rule
File size:496'159 bytes
First seen:2020-06-16 23:36:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b23b9ad9f12b8fc28e61bff35382e32 (1'240 x TrickBot)
ssdeep 6144:uXKJlnagpOWod1+3Ea6dDeCR7yaEnC+lbUGhclavUr1M5Hs+cI9h:rpwYGRb+lbUqcl2Ur25Hs5In
Threatray 2'872 similar samples on MalwareBazaar
TLSH 3EB449C6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350
Reporter ov3rflow1
Tags:malw TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
TrickBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12049/
Detection(s):
SecuriteInfo.com.BScope.Backdoor.Emotet.14181.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.TrickBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 00:09:50 UTC
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
10baa920b0d650a776b4bfdf33e496e574199031cce771d2b1c77b24045ea1a5
TrickBot
1e1da255c1ecdcaf2cb18202ecac91736e0f199d38fe44faa6cfea88b2c86753
TrickBot
2ed913fbde88209f0f5e54c93ac32d7363b95cb6de1539b9e165d53bffb07c4b
TrickBot
4d05e57b2bda1ef716e2ff7c2fbb795d56c88fd6233d24adf5b2a8eaa444d510
TrickBot
54ecb719da5396ca3c08a1dd078e24d6c0b0dd5618d48951596624fd1201422a
TrickBot
a844330bc84aa910a4f4ad13a9d58fe366a950190c8bbb4e41adeeee21152462
TrickBot
b6833c778d84ae6b75548c702baf8aae716ba7ef1a7b766faa97f86d0722e582
TrickBot
cc216f60405041623dc96e0e5cf675e30a9f45e8a16a1286699f1d9af2fefb21
TrickBot
f9355305aa8e663420e1397c20971c0db64230f029a2cde18d40788617049859
TrickBot
f96519f97a57372604e873f252aaf23b468193afdd0ca0f75e4d02f5b472db98
TrickBot
+ 2'862 additional samples on MalwareBazaar
Result
Malware family:
trickbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker family:trickbot
Link:
https://tria.ge/reports/200624-xt8slgllrx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Trickbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/12049/

Comments