Overview

overview

10

Static

static

3

e8e5240832...2N.exe

windows7-x64

10

e8e5240832...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8e5240832ab6f16d4e6512dbecb2a025313f8511c619a0e2c96706dde3b5382N

  • Size

    368KB

  • Sample

    240919-y28h6ayfkl

  • MD5

    d36d0936fd909e33e20adbc0bfc9c310

  • SHA1

    d209e0cce8ea12e6d04c5ca30d6bc7395ebbc78a

  • SHA256

    e8e5240832ab6f16d4e6512dbecb2a025313f8511c619a0e2c96706dde3b5382

  • SHA512

    c6f9503afe245b777ad99a00b67173958210b76a900c05c04e09c668e707010508e97860a25695cbc08bd03cbc55e53085c920c09c3a41483d92546dade99a66

  • SSDEEP

    6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qo:emSuOcHmnYhrDMTrban4qo

Score
10/10
trickbotbankerdiscoveryevasionexecutiontrojan

Malware Config

Targets

    • Target

      e8e5240832ab6f16d4e6512dbecb2a025313f8511c619a0e2c96706dde3b5382N

    • Size

      368KB

    • MD5

      d36d0936fd909e33e20adbc0bfc9c310

    • SHA1

      d209e0cce8ea12e6d04c5ca30d6bc7395ebbc78a

    • SHA256

      e8e5240832ab6f16d4e6512dbecb2a025313f8511c619a0e2c96706dde3b5382

    • SHA512

      c6f9503afe245b777ad99a00b67173958210b76a900c05c04e09c668e707010508e97860a25695cbc08bd03cbc55e53085c920c09c3a41483d92546dade99a66

    • SSDEEP

      6144:eo5N5OazOZaTDWlVnrchrahdOxveC2wo80/agxb0zLz4qo:emSuOcHmnYhrDMTrban4qo

    Score
    10/10
    trickbotbankerdiscoveryevasionexecutiontrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks