Extracted

Extracted

• • Target

    March.xlsb

  • Size

    156KB

  • MD5

    aee94cb5bce75ff1d2e9bb2ca41b40e7

  • SHA1

    fa7239382fb2a406efde23ab0e9ef58ef649c5d2

  • SHA256

    394860f08ba108fbf31adeb687c911f381dced87d1fe78607546397cb78cdfb0

  • SHA512

    f748cfb700318762bda70bb4847ddfd1dc6c6681d801d52537cf8b7f76292f92110d1f04a571f2bccf8eac608d90aa707aa18af4cdd52c743e47d8f554dba31c

  Score

  10^/10

  trickbotmon102bankertrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Templ.dll packer

    Detects Templ.dll packer which usually loads Trickbot.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2