Extracted

Extracted

• • Target

    6.xlsb

  • Size

    190KB

  • MD5

    10360f4838885037c303c5d1e54a40c1

  • SHA1

    e22bc05b3ff0891e18f414f0dc468078bf24720d

  • SHA256

    ab1d6eacd13c7ce70852c85f8da60605b30722d728928ee6d65647750061c6f2

  • SHA512

    8b91f5a5114cc46d034d62dd07006e22a7ced0e0e54df5354243070259111182e851c6a0f7d0ef1225c8eecd12a789e314b709a28c37091f4d2080c2a16a51a0

  Score

  10^/10

  trickbotmon80bankertrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Templ.dll packer

    Detects Templ.dll packer which usually loads Trickbot.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2