MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eeeb95eaa5b30b0cdb8db5a831c40b0756f493785b971f86b43dc7558db1d084. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	eeeb95eaa5b30b0cdb8db5a831c40b0756f493785b971f86b43dc7558db1d084
SHA3-384 hash:	8f9e58b7f9eefe18fd3231ea82d219362f0720889c31e20de368eaed9bf2888dd1d6476ab68b34653da3ec324882659e
SHA1 hash:	7aee74791ad17f3376d7ebd3b20b48644d731d77
MD5 hash:	d95dc647d4c64ea3c2ef97d8d633eef3
humanhash:	johnny-potato-burger-kitten
File name:	SecuriteInfo.com.Trojan.Malware.300983.susgen.26258
Download:	download sample
File size:	594'251 bytes
First seen:	2020-08-25 23:19:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d68a7f00713f10a63b1c459a67eeae6e (16 x BazaLoader)
ssdeep	6144:OJu7yDrEe9+FHM1sYr0JrU4ev9ZOh2At15jUR2EOjvktrYMZBxQTSAfGKEw:OJvD/Ys1l0JfW9H8C25jvMDZBxQ
Threatray	120 similar samples on MalwareBazaar
TLSH	43C49D52F7E449F5D073913ECAA3878AEA72B858473047CB025497192F3B7E19A3E721
Reporter	SecuriteInfoCom

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50814/

Detection(s):

PUA.Win.Downloader.Aiis-6803892-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Transferring files using the Background Intelligent Transfer Service (BITS)

DNS request

Sending a custom TCP request

Sending a UDP request

Launching the default Windows debugger (dwwin.exe)

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/450487

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Keylogger Generic

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eeeb95eaa5b30b0cdb8db5a831c40b0756f493785b971f86b43dc7558db1d084/

Threat name:

Win64.Trojan.TrickBot

Status:

Malicious

First seen:

2020-08-25 23:21:23 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Verdict:

malicious

0d1a4934ca9e0f288ed5eff64218807160472e6d227d679fcb82944f3334041a

20410eaa1c0ea891b4b57a0f0151c5eb441670f9b564a403c06879620b647b85

4480d5c8dc056a509ae830b314b3e70b682ca935655acab9a138f0329ec9f6dc

47c080aace0dc63e0f891ba4b39dcf04ce6c80dc2cfebd993ca5576bdc9f08a9

6ed094ba99e95ac5669ae7a9213f950782612676dba54e971698d127be6e9d75

83bc7eefc084fdbbac8da02ef72a752864aefa956ce3db9d70bab833e8b7b9d0

a4cc8f3c31394e314343d0f40c5b9a81f0fa3ac39399f4bafc9666821bc3317d

cda66e0d6b522863a3e213f14a0e007ef29ff1dbc9b45c90aa9c3db3f77402e4

dc0bca0279910e09caeb1a508eb616d32f3d753f567f050dc04152a9bd587c44

+ 110 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/200825-17qnccbqfn/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Blacklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eeeb95eaa5b30b0cdb8db5a831c40b0756f493785b971f86b43dc7558db1d084

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_uroburos_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator