Extracted

• • Target

    1c199f1108d3932845c37cd73724c3ac2f3b052384abb0a4fe65183013bef225

  • Size

    304KB

  • MD5

    5919aabbf2a93c1f1c2f492a8dac755e

  • SHA1

    02bdabad186f703bb73ad3f79d018996fdea9d71

  • SHA256

    1c199f1108d3932845c37cd73724c3ac2f3b052384abb0a4fe65183013bef225

  • SHA512

    427b36c48e504b9852b8b06407e8fab4dcd83c29589749c09c66aae582d91b67ed857723ddf7263e74a7b00d97860322ffc5b25acb85f2d44f3bdfd38c86076a

  Score

  10^/10

  trickbotser0529bankertrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2