Extracted

• • Target

    d74f6f38f03acb6713cfe0bc28a02673_JaffaCakes118

  • Size

    479KB

  • MD5

    d74f6f38f03acb6713cfe0bc28a02673

  • SHA1

    2d2482fa5beb63724d86e2c45fb74664c51d910a

  • SHA256

    4e9a82dfa6162528e576b36551313540f52394cc82f276684f85cf34182aee2b

  • SHA512

    21080d91fd1761150fcb2fd190e33203965e79a67937674163a0de7d4922d6f8e5e30c525cce79f4146afd871702cc96498754eec2a1b298bf6907a1de03c732

  • SSDEEP

    6144:ZAFhfEh0YAppPTxSKZNceVL5t0e6drt1mCkFRvFFQhlqKEp/wCqY:ZcEWYAbTxD0eDtHCJ1mCkFRvghusY

  Score

  10^/10

  trickbotjim315bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2