Extracted

• • Target

    d61ca02b30b949fcc13e1876304a66a4_JaffaCakes118

  • Size

    565KB

  • MD5

    d61ca02b30b949fcc13e1876304a66a4

  • SHA1

    c33de07051e054c0ddeacdbcea94a348681d9233

  • SHA256

    5ec54b2f42a83caefb37ff13b059ca792c0fba6529412487eda9483bc6841325

  • SHA512

    0c3e7e023c85a4cbe4c285ca8d3fd87d5a3ae65dc5cdc263e78c68956bc07af3457d20bedee31364faf1acd21044bac531106d92488f4a5ab6cc924fd8361f53

  • SSDEEP

    6144:OtNFZSWXD/Q9Z9OOOeh0znqNZX4tjKMQjmUvgqBUnZBucD4f4RTg1EoGhw2/K67/:UjZS+D/Qv9O0xqjK/jmjBH4gxMbGZ

  Score

  10^/10

  trickbotsat76bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2