Overview

overview

10

Static

static

3

setup.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setup.exe

  • Size

    2.0MB

  • Sample

    240503-zgg15seg7w

  • MD5

    b28cd162cebdb7adfa81871887800496

  • SHA1

    154a2ba2df7e811df6a4236a68d088c094655bb9

  • SHA256

    7bde12d17f015c3fbf7ac2633c959179ed820da08274ace5afa5687413c3f056

  • SHA512

    e90c9d7364837d84ca2ccb7207769c5ff8ea9290ea025d963827223a706fc82d3a616161a009d108b9bd93acfeec1350b5c05ae0a3d73623db74058afc4f2bbb

  • SSDEEP

    49152:Jqe3f6XyZZKHghFnDTSESc0D7KSTZHZ9YcYK:gSiCZZyQND+LNhZ9+K

Score
10/10
trickbotbankerbootkitpersistencetrojan

Malware Config

Targets

    • Target

      setup.exe

    • Size

      2.0MB

    • MD5

      b28cd162cebdb7adfa81871887800496

    • SHA1

      154a2ba2df7e811df6a4236a68d088c094655bb9

    • SHA256

      7bde12d17f015c3fbf7ac2633c959179ed820da08274ace5afa5687413c3f056

    • SHA512

      e90c9d7364837d84ca2ccb7207769c5ff8ea9290ea025d963827223a706fc82d3a616161a009d108b9bd93acfeec1350b5c05ae0a3d73623db74058afc4f2bbb

    • SSDEEP

      49152:Jqe3f6XyZZKHghFnDTSESc0D7KSTZHZ9YcYK:gSiCZZyQND+LNhZ9+K

    Score
    10/10
    trickbotbankerbootkitpersistencetrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks