Extracted

• • Target

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

  • Size

    380KB

  • MD5

    44de98af8b6588ea597cdc95844fdda6

  • SHA1

    2c222cf976ab93c63a494bab2c4bf35b0e3c894a

  • SHA256

    576352d72a627ae9cffc50abd3ca9930e92ec823724b4b5186a1dbd2df1d48a2

  • SHA512

    cde452c4de6fba7bb9e47a1f3543cbe1fe64fc727047e3f0edfa62ec5ad078e496234d0b8e14c2db1fed973f32daee72394d6d8f440a0ff84f4cb2f68771ff76

  Score

  10^/10

  trickbotser0516bankertrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2