Overview

overview

10

Static

static

3

e1d6ff39a5...18.exe

windows7-x64

10

e1d6ff39a5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1d6ff39a5c4388044f4e8b40ff53e1c_JaffaCakes118

  • Size

    300KB

  • Sample

    240915-gpydzsyeqa

  • MD5

    e1d6ff39a5c4388044f4e8b40ff53e1c

  • SHA1

    4b85c7f501ccba7a564f7d78d05620c034595832

  • SHA256

    c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

  • SHA512

    80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567

  • SSDEEP

    6144:lnx9RtQLCgTCK44RFSrIPcLLCLohzSE8v6ejjFI0Pl/DG1V9sbPeC3YU+d6IUg:lcPcvlp/ejRd1WbiTIdw

Score
10/10
trickbotbankerdiscoveryevasionexecutiontrojan

Malware Config

Targets

    • Target

      e1d6ff39a5c4388044f4e8b40ff53e1c_JaffaCakes118

    • Size

      300KB

    • MD5

      e1d6ff39a5c4388044f4e8b40ff53e1c

    • SHA1

      4b85c7f501ccba7a564f7d78d05620c034595832

    • SHA256

      c776b12d0ffc08ce7e877fef67780f2de60f23977796281c5d7a524c05a92d5b

    • SHA512

      80ce564cf165f14c917c59222b9a23a998716941f8753c4d0194739d299572ccc1037ef6a0b71e32f08fde470d6117b3081b99c7c71eb7b4bdf4cbb677445567

    • SSDEEP

      6144:lnx9RtQLCgTCK44RFSrIPcLLCLohzSE8v6ejjFI0Pl/DG1V9sbPeC3YU+d6IUg:lcPcvlp/ejRd1WbiTIdw

    Score
    10/10
    trickbotbankerdiscoveryevasionexecutiontrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks