Extracted

• • Target

    ced7ffbe44b657360ade1d0b52f2587e_JaffaCakes118

  • Size

    348KB

  • MD5

    ced7ffbe44b657360ade1d0b52f2587e

  • SHA1

    652caf6d1ac224983027f6176a90424547608345

  • SHA256

    7aa0722dd865ebf63a7ff30db265862388a14cec3144dcd47643845a60a398ff

  • SHA512

    1d5c2eeda8a8b54acc57b61412ff731788572fe3257421b977bf934573b8b34c0423f9a491a0e2cab4e79014c82ab35542ac8cedeb69051997453d29c35bf831

  • SSDEEP

    6144:c5WV38sM2nwYuxTNCTFppNt0pzIZ5la22tVjSYevA8:2m33MiYSTFppNt0ptj/j/evA

  Score

  10^/10

  trickbottt0002bankerdiscoveryevasiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2