Overview

overview

10

Static

static

375a3e1789...e0.exe

windows7_x64

10

375a3e1789...e0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    375a3e17894f0984b5ae84bd893720c5573c6c717e1e76864c9486044be493e0

  • Size

    701KB

  • Sample

    220625-3lb78sgedp

  • MD5

    cf9d356d297418dcff7082d520ebcc2c

  • SHA1

    46e95a3acf71ce3a2cd92980c1da66577b0ec8bc

  • SHA256

    375a3e17894f0984b5ae84bd893720c5573c6c717e1e76864c9486044be493e0

  • SHA512

    6e0638d77017e5aa3d44018294eb9cacacb6f4df25e50f1e04377a000b07a06e872ba438c527cf80506d1de6f27ffc3ab07f5803cfc461045256f30eb1b91d36

Score
10/10
trickbotbankerevasiontrojan

Malware Config

Targets

    • Target

      375a3e17894f0984b5ae84bd893720c5573c6c717e1e76864c9486044be493e0

    • Size

      701KB

    • MD5

      cf9d356d297418dcff7082d520ebcc2c

    • SHA1

      46e95a3acf71ce3a2cd92980c1da66577b0ec8bc

    • SHA256

      375a3e17894f0984b5ae84bd893720c5573c6c717e1e76864c9486044be493e0

    • SHA512

      6e0638d77017e5aa3d44018294eb9cacacb6f4df25e50f1e04377a000b07a06e872ba438c527cf80506d1de6f27ffc3ab07f5803cfc461045256f30eb1b91d36

    Score
    10/10
    trickbotbankerevasiontrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Impair Defenses

1
T1562

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks