Trojan.Trickbot.FD
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 10,014 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 252 |
| First Seen: | March 7, 2023 |
| Last Seen: | February 16, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Trickbot.FD |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
7aa0b944aa5470adb9bd678880a36775
SHA1:
9db26a29fcd4e7abced79db088728db48ece3889
File Size:
3.13 MB, 3133961 bytes
|
|
MD5:
42f13782720788c8f0410b251b16b063
SHA1:
555513da860fcc43efa7250970fc38dcde497fac
SHA256:
3E8AF34967A12AB721FFEEADD5C19B47D6BC808FAB091DCC0A901CDF04A45516
File Size:
3.13 MB, 3133938 bytes
|
|
MD5:
10c433b7374854e0a7905edb7d22ec83
SHA1:
290b1e6ba28414d8592d698d71db9d21ef74373b
SHA256:
91F2A3E961F54DB0306459560AAE99E50B6A38A7C09612057BA46B6F02B6DB81
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
a6965e8d75b31ae2642fc18d3eccf35f
SHA1:
fe62516bc2b4b6c06f2622df24c040662fc23965
SHA256:
E9C9E4A3320466EB832CE1D9210F89ABA4117F0CFABB4F0C58E7382174C013A0
File Size:
3.14 MB, 3136075 bytes
|
|
MD5:
491753f0665bbfe7124649816952095e
SHA1:
ee3ab1f873a9ec80cab77949cf97a991b34b0693
SHA256:
9022FE120D83AFDE54939F8183FDE1E1300D33B2CAFA57A4C8A9573F38DC8383
File Size:
3.13 MB, 3133915 bytes
|
Show More
|
MD5:
84febcca1e43080d3f5c86e62f93a8ee
SHA1:
dc666df84f986b72e0a95aecaf9ee1673079dcfd
SHA256:
D9D3EBC32346B5C35FAEB36123EA8C45B9E6700552236A8E0C3B634BEBAC81EC
File Size:
3.13 MB, 3133761 bytes
|
|
MD5:
6626581c74f2283fcb8c46c7c447b028
SHA1:
c626d3cc7d78ab056bc8042497d4bc36db300d3f
SHA256:
57DCF68A4444770EE5E45E007C54F774A52FC9A87D27B0C7248207C734F7A2B0
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
69945b23e7a2718067bf9062ec81ed0b
SHA1:
100e00c4d90868ab90a964974f81ed79d5a4d7a4
SHA256:
6A36C47EB0F7DCBEF404224C35B7668B45136197D7D141E849E273CEF4351916
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
366be999909adbb9b3af9cd91a6f6f86
SHA1:
ac776922a132e3f1e3b4e70bd9b7a9b6da7d4ee2
SHA256:
82F3868A9E18EE96CFB69678D24A0C45BF9F39D0766475A26965B34155B9B66D
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
44d1c7ec1bbabdae9ae8c6ab1607795c
SHA1:
37022dc2bb58ccad1de06f3f51c8586997cfb4b6
SHA256:
1518084853D0642BE8AC95B0054F5CF94D18572BA7DEB647D5CF68BE8D44EF44
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
fa8e56719a9ed173e9b681bd814a50c8
SHA1:
0b3a99e2d6afff478be7291f5ac6a5f862f2ffc3
SHA256:
074D48B88A06EF2F5B493C4E8F22051D0EF6A60DB71AB07A4075838E6D20FE2D
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
e715d196e93ccfc3c27fb31d24ced62b
SHA1:
c4325e03e9ce85357dbee8f46e587c469186a7b3
SHA256:
615C9E962CFCDBA0F69D1740CD2AFA570F7D380694564C8F0A067C624FBAE691
File Size:
3.22 MB, 3221574 bytes
|
|
MD5:
1ea122038da88bd845e3cb91c55b811a
SHA1:
a6c09904ae94f8bb8d3a3775ea3cdaaef26d9f4a
SHA256:
496E27DD35C427EF2AE9C0B461E650F2BB6C778C56FFB6C001234DD76D1C21C0
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
200609ea12f1e5407bf5a107e97fb5ab
SHA1:
97246d415607a6d22a0c9d058eba57e0b43ae6d0
SHA256:
0207E7C4485479CD367900CB2796BEF39E3DD5552EE42090B4F394A3A5DB5E90
File Size:
3.13 MB, 3133954 bytes
|
|
MD5:
b18d989938d9fc2d230bd3ba27db757c
SHA1:
c3bb8f6764fb58eae8c17269653e79235d983d01
SHA256:
79B26F90A3E8806A2D11122DDF6B278F35450A8ECE701FCD91AC75FCC5E2A548
File Size:
3.13 MB, 3133720 bytes
|
|
MD5:
370e03859d09dd832db5ccbbdfcaf1a3
SHA1:
db810f768f3be0d7c5b3f29c0966dac6fe896970
SHA256:
A43AA034949ABA34546544F90930265DC44A7E358050719FD06074CE5699E782
File Size:
3.22 MB, 3221038 bytes
|
|
MD5:
a2ae573ceba0c009c8ee63bab94e4511
SHA1:
3f3dd69eb6f5f4209472b56b7a9fbe14060613bd
SHA256:
3D0AEAEA536F92E0A5758E9A26E6D4DD543BD01E4A473555E41917BF6C95344A
File Size:
3.13 MB, 3133915 bytes
|
|
MD5:
3725dc09f6465ff230be4b5f93e7e7cf
SHA1:
38ad90494befe71b68bbba001aab5d260e6c1532
SHA256:
269A67FBA0FD256E6E77AC33B5571B9C29C16597E91DF09A931F77F51950769A
File Size:
3.22 MB, 3221550 bytes
|
|
MD5:
458123a2e11d1157127eec20ac2dd29b
SHA1:
a8deb151d6b207d4f53b28a1473c5851c10fec95
SHA256:
A7751E071CCB3F4939209A0FC956A09085468EE4C0E608B329EA104D6F18AC04
File Size:
3.13 MB, 3133915 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- big overlay
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 10,415 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 10,414 |
| Unknown Blocks: | 1 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Adaptix.A
- Agent.BMG
- Agent.BMGA
- Agent.BMGD
- BadJoke.GF
Show More
- Badjoke.FDA
- Brute.DM
- Downloader.Agent.BTTA
- Downloader.Agent.BTU
- Filecoder.DASA
- Filecoder.RAR
- KillMBR.AO
- Kryptik.EDIU
- Mimikatz.CWG
- TrickBot.FJA
- Trickbot.FJ
- Trojan.Downloader.Gen.FM
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
