Extracted

• • Target

    d54d23f5fdbf03c102598d85742ac004_JaffaCakes118

  • Size

    572KB

  • MD5

    d54d23f5fdbf03c102598d85742ac004

  • SHA1

    c16a75322df05c9ee837b4443f6fb236523ef0f7

  • SHA256

    e7638cdc2efcbfe15e47873199e69acb7557c6de78969dd6bab656896386e4a9

  • SHA512

    8bc25eaacfc19bb83d164756978b20a9d7ed49a30457be208de5c292bf2fc894ef995031ece21e319c6746f6f91616f02b5e5c9ce898e57a1d95543f72d5fb79

  • SSDEEP

    12288:IygFNIq7ECxVakKdlB2nToJ37RVtBq8H:IymhAIu2nQVVHx

  Score

  10^/10

  trickbotbankerdiscoveryevasionexecutiontrojanser0829us

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2