Overview

overview

10

Static

static

7

e2e2c4bbc6...18.exe

windows7-x64

10

e2e2c4bbc6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2e2c4bbc65b73b3f8b5dfe038bae33c_JaffaCakes118

  • Size

    402KB

  • Sample

    240406-tawcasdf9w

  • MD5

    e2e2c4bbc65b73b3f8b5dfe038bae33c

  • SHA1

    d4470558a1aa80214bf3a2cb4f29ed6e23a490f8

  • SHA256

    c4c2fb576b274c45f28f16096814b48e50f01d167be68ee2fbcc4cffab37a35b

  • SHA512

    a9dcae93ffa9498264fead80da6bcbcd61ccec6804a69b32b7eb8cc15be97bf8580c3369dbdf81f07d309b90cb6f922e75aa3598994367042cdb76203e18a165

  • SSDEEP

    12288:eI+rhWYrwYZgjuPhIarGlkgxdv5f8khn4xX:B+95l77rMHZF8hxX

Score
10/10
trickbotbankerdavetrojanupx

Malware Config

Targets

    • Target

      e2e2c4bbc65b73b3f8b5dfe038bae33c_JaffaCakes118

    • Size

      402KB

    • MD5

      e2e2c4bbc65b73b3f8b5dfe038bae33c

    • SHA1

      d4470558a1aa80214bf3a2cb4f29ed6e23a490f8

    • SHA256

      c4c2fb576b274c45f28f16096814b48e50f01d167be68ee2fbcc4cffab37a35b

    • SHA512

      a9dcae93ffa9498264fead80da6bcbcd61ccec6804a69b32b7eb8cc15be97bf8580c3369dbdf81f07d309b90cb6f922e75aa3598994367042cdb76203e18a165

    • SSDEEP

      12288:eI+rhWYrwYZgjuPhIarGlkgxdv5f8khn4xX:B+95l77rMHZF8hxX

    Score
    10/10
    trickbotbankerdavetrojanupx

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks