MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eec13ba57b49bac069e70ccd6922df9e5ea34f9e9787aa686e6bf327a10dcf8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


TrickBot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eec13ba57b49bac069e70ccd6922df9e5ea34f9e9787aa686e6bf327a10dcf8b
SHA3-384 hash: a82a1945f56092e3d0c79273d67f53343d11e0bdd7de86fac0aa8d451809ea82c79e4b3010b0639e79b006366ed9e094
SHA1 hash: dc5ad30bd4aecb3e3528371be1e5f6d9be9e187e
MD5 hash: a214474396d42c8587df9dea653d79bc
humanhash: wolfram-finch-zebra-echo
File name:eec13ba57b49bac069e70ccd6922df9e5ea34f9e9787aa686e6bf327a10dcf8b
Download: download sample
Signature TrickBot
Create hunting rule
File size:424'446 bytes
First seen:2020-03-23 16:19:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d65ad2821e9c5eb63c432ac2cecda7fe (1 x TrickBot)
ssdeep 6144:5aqKTRNjxQ1XUffZ5Lm771lTrnjeZPpePqt+DHv3cyyLIhCnNPhBFgMU0B2:5OtVx+EffZweJSvMMCnNXFgM8
Threatray 367 similar samples on MalwareBazaar
TLSH 5B9401A47B54CD84CAB753B8556A9EAE0F2EEDF60D1050F7F885BECD2931B418CA9402
Reporter Marco_Ramilli
Tags:exe TrickBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.TrickBot-7054564-0
Create hunting rule

Win.Dropper.TrickBot-7055694-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 03:57:46 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=53atxjl3jg5ma2phbtgwsiw7tzpkgt46s6d2u2donpzspiinz6fq._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
Similar samples:
34e142c3ca75844c48639cfc8f60513d23c02a65addef3bce69f5b49b34277a1
TrickBot
4a97c7666ce53a862a84873ad6bcfcd84b5cddd216ac6aa4f15998802d90f94e
TrickBot
4b1a2896d4203f63a22b95186b139b6fc02af494f60e33d796694f70cdb0f429
TrickBot
5b5eab7a12fdfc6cc39e39193b7a9020ee46e72acac70033236ef9b6b2da32c7
TrickBot
5ef8714caf9c7296847b67b27edb93c3aec23d7e77b57d23d0e8607d707a2c49
TrickBot
6a46de11b9ebaaa99cecd10012b7532e5d323d9ddf5bb25309f6fbf47f192fde
TrickBot
6c90f16a6932be921cbb44b9e4531cf36e5ded6d5dd0016c4309a56ab8a96461
TrickBot
9dc88dec4a1a8fab1526dd1a856542e011b7ad5a62ec049c07d0eca58843a9f0
TrickBot
bf63837b5da7be5191e1c0b79a827ce8649971297f355845ae968cc44c7d9162
TrickBot
e33efffc8425fb12d4d9f8c18a066d7f80d328cf7a74a235acf175d587146e9c
TrickBot
+ 357 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
MULTIMEDIA_APICan Play MultimediaAVICAP32.dll::capCreateCaptureWindowA
AVICAP32.dll::capGetDriverDescriptionA
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateFileMappingW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::CreateWindowExA

Comments