Extracted

• • Target

    c2e8650780dce959f36ce7c970002a85_JaffaCakes118

  • Size

    417KB

  • MD5

    c2e8650780dce959f36ce7c970002a85

  • SHA1

    49f5e5f341b088611d318f38072b4abe502cb126

  • SHA256

    2c67fac475f845453339466b9c09164902a64a248ea9a87a3c736ff000af7f63

  • SHA512

    28ea3d276e21a8122bee11093e9b79f31baf5eaf6c759a3a05e42903f2d09ac807e670757a41486054c56d1a5791620ffa87d7d157fdc9b51bf2d99f2e05bc57

  • SSDEEP

    6144:0LP8Z80Z5MjCCHQONLBB8moFGl7xY9b+:6Unke61D8B4BxY9q

  Score

  10^/10

  trickbottt0002bankerdiscoveryevasiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2