MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f9f065cfe7edfa8c365bf45a46fd73081af15a53b9e67fb8a76f6060b142b7dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
TrickBot
Vendor detections: 8
| SHA256 hash: | f9f065cfe7edfa8c365bf45a46fd73081af15a53b9e67fb8a76f6060b142b7dd |
|---|---|
| SHA3-384 hash: | d70d183227427922df12a7eb275f3da76d979e17835184384893e1fbea74310c4ecceea057b869f1ab616f682318304d |
| SHA1 hash: | 6ff556db0d9dd97c933ff8f2d2a871c03f3ba9ff |
| MD5 hash: | 8ac7b9954375d58bf6f1934377b5d4c8 |
| humanhash: | three-alaska-lion-fruit |
| File name: | dtab.exe |
| Download: | download sample |
| Signature | TrickBot |
| File size: | 1'000'448 bytes |
| First seen: | 2020-12-21 18:49:02 UTC |
| Last seen: | 2020-12-21 20:47:18 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5abb3d9b9122807b8aa66b54f1d9283e (1 x TrickBot) |
| ssdeep | 24576:HUXugzMY25urwjwchB2QKvumMnkUtI1x77uLbNs:HD2MV5uswcXls2Ns |
| Threatray | 2'970 similar samples on MalwareBazaar |
| TLSH | CF258D644D2A9220D256C63400D972B1D73AFE366E0C16A7D5AD77ECAC307A28F77F06 |
| Reporter |  malware_traffic |
| Tags: | exe mor2 TrickBot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dtab.exe
Verdict:
Malicious activity
Analysis date:
2020-12-21 20:46:54 UTC
Tags:
evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Signature
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Potential time zone aware malware
Behaviour
Behavior Graph:
Detection:
trickbot
Verdict:
malicious
Label(s):
trickbot
Similar samples:
+ 2'960 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
f9f065cfe7edfa8c365bf45a46fd73081af15a53b9e67fb8a76f6060b142b7dd
MD5 hash:
8ac7b9954375d58bf6f1934377b5d4c8
SHA1 hash:
6ff556db0d9dd97c933ff8f2d2a871c03f3ba9ff
SH256 hash:
8be8d0596e145fb15886cbd83d605b82a69abea104d21210e887dc299754924f
MD5 hash:
d25f251658b31075cbf03b52c65678d3
SHA1 hash:
ad729ea8de07568845d6ae9f746fde92e52e3c31
SH256 hash:
79e2976b7c5bee3186b9223267183935b2ca07da520bc81e019949f54aaf77e5
MD5 hash:
ed851a132454c3eb25504624e495934e
SHA1 hash:
04e9fed7187ffb90a5aff05ca6c52a88e6a85e98
Detections:
win_trickbot_a4
win_trickbot_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Virut
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.