Extracted

• • Target

    c7a0cae4eeaeca56e467505b1e8f7bfe_JaffaCakes118

  • Size

    429KB

  • MD5

    c7a0cae4eeaeca56e467505b1e8f7bfe

  • SHA1

    5898c55e1a79d2e887b41a1d94591cab84fceb39

  • SHA256

    ac8587f6955784f9a2d6cf70bcdce024122c8ec7b459b7e9c8da99dec5d125e0

  • SHA512

    7e98f818f68c06d86bfe7623dc9b31ca1f25ef700d2bc9748df2c6db6cec077321478699d5e41fe3ebcfd7c67993c9270620c29008ec322a67c6565a38e8ac68

  • SSDEEP

    6144:dfajn30w5Wet/sX6k1hsny0FW2Vd++gthfF9LX75Eau81zvxrpD:dfaj3JYMyonXdVo+yvu8h

  Score

  10^/10

  trickbotlib362bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2