Overview

overview

10

Static

static

3

dc0bf2c3bd...18.exe

windows7-x64

10

dc0bf2c3bd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc0bf2c3bd42044b7878e1c166276049_JaffaCakes118

  • Size

    170KB

  • Sample

    240912-h1z8dsxfja

  • MD5

    dc0bf2c3bd42044b7878e1c166276049

  • SHA1

    0fb795778e8c3a3ee8d45e331418fec8c2a79b15

  • SHA256

    b5de393db7bb75539807bc46a9a9e48ac5f98037309c0c01a7f0b26f6b546e7e

  • SHA512

    7c9a28daf240778bea35e0a0c902bc65dbfd6f03562899d6afe7f60e22d77bf3677704d3a6bffd7ad58f9af39edcb94afc411ece1d348b36d3020a1865a6842f

  • SSDEEP

    3072:SZdQdgNBseXB0825Biw2uuhB2RSCk8rFBItKZTHLoOZsUg3:f6HseXB0JBii02rFBItMHuUg

Score
10/10
trickbotbankerdefense_evasiondiscoverytrojan

Malware Config

Targets

    • Target

      dc0bf2c3bd42044b7878e1c166276049_JaffaCakes118

    • Size

      170KB

    • MD5

      dc0bf2c3bd42044b7878e1c166276049

    • SHA1

      0fb795778e8c3a3ee8d45e331418fec8c2a79b15

    • SHA256

      b5de393db7bb75539807bc46a9a9e48ac5f98037309c0c01a7f0b26f6b546e7e

    • SHA512

      7c9a28daf240778bea35e0a0c902bc65dbfd6f03562899d6afe7f60e22d77bf3677704d3a6bffd7ad58f9af39edcb94afc411ece1d348b36d3020a1865a6842f

    • SSDEEP

      3072:SZdQdgNBseXB0825Biw2uuhB2RSCk8rFBItKZTHLoOZsUg3:f6HseXB0JBii02rFBItMHuUg

    Score
    10/10
    trickbotbankerdefense_evasiondiscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Deletes itself

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks