Extracted

Extracted

• • Target

    SecuriteInfo.com.Heur.26940.27082

  • Size

    192KB

  • MD5

    3ced3a99f232fabf65e51f8a67ba68d2

  • SHA1

    2e608a4fa4d17efb6763783424282011f3d328c0

  • SHA256

    0426cdbcc2cbd587d32d4324bed89a4a80bca59bd880bdc8b1efc4810d4ed2bc

  • SHA512

    bdf7239078858836a6ee6e68fd3692cfd22a49a3f4d8f28e9e00edf55de1114cfec71641f7b6566b972b2ef7bd5d30c3d0e68758661d4fb9bad0d7f4873af1ab

  Score

  10^/10

  trickbotrob72bankertrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Templ.dll packer

    Detects Templ.dll packer which usually loads Trickbot.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2