trickbot | 02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c | Triage

Submit
Reports

Overview

overview

Static

static

3

c74656862b...18.exe

windows7-x64

c74656862b...18.exe

windows10-2004-x64

Sharing

General

Target

c74656862b16f81d02c109030260245b_JaffaCakes118
Size

456KB
Sample

240828-vkw71sxane
MD5

c74656862b16f81d02c109030260245b
SHA1

53b97a9f6b4894d99386a42ab7196d83b719e012
SHA256

02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c
SHA512

ca9283c703e2bbbe2ef6a5291d8460663750a9bb9df41eeecc3bb6fef78db0a0b9a529a68c9b0ccbf288389bc9a42a4f654df4d3e2487bbdd7235ba285123c72
SSDEEP

12288:ggwIEzEGoC8SeBEpS/os40J/tZ3D6jTJ+yXh:gWEzWC85E40u/LEJlh

Score

10^/10

trickbot banker dave discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

c74656862b16f81d02c109030260245b_JaffaCakes118.exe

Resource

win7-20240704-en

trickbot banker dave discovery trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

c74656862b16f81d02c109030260245b_JaffaCakes118.exe

Resource

win10v2004-20240802-en

trickbot banker dave discovery trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  c74656862b16f81d02c109030260245b_JaffaCakes118
- Size
  
  456KB
- MD5
  
  c74656862b16f81d02c109030260245b
- SHA1
  
  53b97a9f6b4894d99386a42ab7196d83b719e012
- SHA256
  
  02db3c6b9aff73bf8a11c41107c836b6c800c919c5d3d1304f336aee03f79f4c
- SHA512
  
  ca9283c703e2bbbe2ef6a5291d8460663750a9bb9df41eeecc3bb6fef78db0a0b9a529a68c9b0ccbf288389bc9a42a4f654df4d3e2487bbdd7235ba285123c72
- SSDEEP
  
  12288:ggwIEzEGoC8SeBEpS/os40J/tZ3D6jTJ+yXh:gWEzWC85E40u/LEJlh
Score

10^/10

trickbot banker dave discovery trojan
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Dave packer
  Detects executable using a packer named 'Dave' by the community, based on a string at the end.
  dave
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

trickbotbankerdavediscoverytrojan

behavioral2

trickbotbankerdavediscoverytrojan

© 2018-2025

Terms | Privacy