Extracted

• • Target

    d1a457c76250cd0ad73385fac4ab43e4_JaffaCakes118

  • Size

    510KB

  • MD5

    d1a457c76250cd0ad73385fac4ab43e4

  • SHA1

    51fafa0a3ca7887230b301a6932a1b3c8ae10982

  • SHA256

    66a4f5df35234205ad530a1123c7021afb75623b0e16e53143bc553b6adf595e

  • SHA512

    2eebab473b69798a73832f328de3b9ac127d77e8a90c8036a0aa1922fdb0e64ce673dfb14e0d45ce4bd6c6604286f22c93b1e907df931a69c918d10452451307

  • SSDEEP

    12288:S0I5i9PUpF1vnXnrIGQRB9RpHRQXoEa4OoMbGv:GcQ1XxU9RldvoMbGv

  Score

  10^/10

  trickbottot331bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2