Extracted

• • Target

    dcc0d02b0936131d89752daf8cca3b5c_JaffaCakes118

  • Size

    578KB

  • MD5

    dcc0d02b0936131d89752daf8cca3b5c

  • SHA1

    195c29cfbd04f7bf2e2c90c930f34c712f436883

  • SHA256

    24d775cde5e5b069948e25d7e38ba2bc41326e5a06ef33c653b958956ce8bab6

  • SHA512

    6a57105a0d6db92e3dce0b429f228b78626f94610103cefdd7a1fb051b9d032dca56ebd2adbfef177d6ff050e30045c152e7791d4f137daa4b2923ce7b4bdacc

  • SSDEEP

    6144:XHujQMxnzItdLPrBF4sMh1dvQYn2s7V6LR98iTpkG6qKBvw3EBXF48gEg8D/zoM:XOXxnzIz9MyA1MR9zpkD7RwyXWEg8Db

  Score

  10^/10

  trickbotbankerdiscoveryevasionexecutiontrojansat100

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2