TrickBot.7z
- SHA256 bc65b98c3fc6834aa40874ecea2463cb5ce5894635a694d83ff6f0f23cb8cae7
Password
infected
Static task
static1
1 signatures
General
- Target TrickBot.7z
- Size 44KB
- Sample261012-3lp44aszbw
- SHA256 bc65b98c3fc6834aa40874ecea2463cb5ce5894635a694d83ff6f0f23cb8cae7
- MD5 eeb34a1c420111d29eb279f7eac852bb
- SHA1 beb8211f2af40e91564ab8f47d8a41cdbc35f100
- SHA512 eb0ed324c1fd1c9dcc6b5d0c7e67abca1d942593ab767d58ecc5f4ac241bcdd7f9c486368a1cb7b5506daf154afdbfd6ad5df8e78129e7ce33111cf8cdac983b
- SSDEEP 768:mfkQQtzxdwGvHFxPC49mBRyP4pHDYn5i8tfl0lDZqTJZT0VuoYTpHFGJZ21CAbVI:kkQQt5wu4pH8tNuZqlqQ5Zp5i4m
- TLSH T1FF23011FC56B7EB9674D1A9320785201420DAB8CFFA42E2514EA2D081377B8D85FE5F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d
File Explorer
-
TrickBot.7z.7z 44KB
-
3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d.exe 192KB
3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d
- IMPHASH ab7926589d5dfea5e9c26dbeedec8ebb
- SHA256 3bf0f489250eaaa99100af4fd9cce3a23acf2b633c25f4571fb8078d4cb7c64d
- MD5 39bf48682793069ecca03d4eef46ecac
- SHA1 edc0a959b659659717af06157407015771f68bf5
- SHA512 7c98007283f55c1d4216c2033526920cec8896d7f4a1c7df50650a43bab9df7f4c3f6549241810213915a93fbe6e5c5d3eb1465b66bed092dd663fddcb6c2e2b
- SSDEEP 3072:AKvTOrKzbLOVyiRBKXu79eIsunG1zgMl8UXrhQcgx/:AKHGyTw9eZuG1Fl8irfgx/
- TLSH T1C714D52AF31BD0F8DD2764B2650BE2E76DFC7F018810AD4DCF455C19B929D1B0A24A69
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
7859
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
EqualSid
FreeSid
GetTokenInformation
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
kernel32
CloseHandle
CreateFileW
CreateRemoteThread
CreateToolhelp32Snapshot
DeleteFileW
ExitProcess
FindResourceW
GetCurrentProcess
GetCurrentProcessId
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
IsWow64Process
LoadResource
LockResource
MultiByteToWideChar
OpenMutexW
OpenProcess
OutputDebugStringW
Process32FirstW
Process32NextW
ReadFile
ReadProcessMemory
SetFileAttributesW
SetFileTime
SizeofResource
Sleep
SystemTimeToFileTime
TerminateProcess
VirtualAlloc
VirtualAllocEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
WriteProcessMemory
msvcrt
_iob
_vsnprintf
_vsnwprintf
fgetwc
getc
memset
memcpy
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
oleaut32
VariantClear
shell32
StrStrIW
shlwapi
StrCmpIW
ws2_32
FreeAddrInfoW
GetAddrInfoW
WSAGetLastError
WSAStartup
__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
144KB
Virtual Size
143KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE