Extracted

• • Target

    b1f04b467115b366a8d8b76fd4da6cc7_JaffaCakes118

  • Size

    299KB

  • MD5

    b1f04b467115b366a8d8b76fd4da6cc7

  • SHA1

    860f3a96d57984d0112521e9eb31e30ed2498033

  • SHA256

    225d41fc5d44936822f7b137ecf6156ed4a3d08439b1b2f9633ccfbc51fad7d6

  • SHA512

    80f3ddefaf0627e12cf7569afb83789384788e9cd65aea4a7eb8f3f030469fd067e4e4c029512857ee28c2011e8076d1d97ac676524c79bf987dc337f088d5ae

  • SSDEEP

    6144:eAiBe5v1c1TGVMftOGoBButUAG7l7eNwVIeCi0a5bZq/4kCBuc:xig5y9i2OrIUAG7l7eNwVI6vKAkCB

  Score

  10^/10

  trickbottot314bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2