Overview

overview

10

Static

static

76ab3bab55...b0.exe

windows7-x64

10

76ab3bab55...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

  • Size

    492KB

  • Sample

    220731-kwt7paabej

  • MD5

    e29212a7f10f41c4404f694162b91de8

  • SHA1

    cb189d1eb74822a12b3f4efba5328400d7d81da0

  • SHA256

    76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

  • SHA512

    a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

Score
10/10
trickbotbankertrojan

Malware Config

Targets

    • Target

      76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

    • Size

      492KB

    • MD5

      e29212a7f10f41c4404f694162b91de8

    • SHA1

      cb189d1eb74822a12b3f4efba5328400d7d81da0

    • SHA256

      76ab3bab55e55afdff24f971410b2e7b071edac304bddb791d687a0c084289b0

    • SHA512

      a86688ac819f7692ee7bc485bf7d89e53f6f422dffe036aa5a10730c82c6db816a4b25583835a77b8c76d674e5ac0b800752c5d6c69ca1c8cbd3003fa72ac40b

    Score
    10/10
    trickbotbankertrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks