Extracted

• • Target

    c6be1119d2cd2cb9a61b70a285e4217e_JaffaCakes118

  • Size

    472KB

  • MD5

    c6be1119d2cd2cb9a61b70a285e4217e

  • SHA1

    f127eef4996fbde42a6ecc90ce7a8695db89a85a

  • SHA256

    0ed216cf9cd95d8d542584675af8f7cc03017541496faf60d7781fd93ee2e11f

  • SHA512

    b43beb4cd8463b33af3300e8bb95aaab180b63f79d54c03b6b353d2c8db704b995635d7a208f50f99cc57ea7e267563adbaf53bb9feba2f71056bf6ddea9e351

  • SSDEEP

    12288:G0/XMnpanXMipayIXMipasXMnpapXJR4iZxk83k7VYm2:G0/XMnpanXMipa3XMipasXMnpa574ck+

  Score

  10^/10

  trickbottt0002bankerdiscoveryevasiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2