Overview

overview

10

Static

static

3

eec2a5cc87...18.exe

windows7-x64

10

eec2a5cc87...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eec2a5cc875cd35d9334725f1a6f926c_JaffaCakes118

  • Size

    252KB

  • Sample

    240921-a7ldtaxclf

  • MD5

    eec2a5cc875cd35d9334725f1a6f926c

  • SHA1

    5ada78b6e5f667996a58246de1ad0453d6eff026

  • SHA256

    50709a83b665c2d2286d16395a93034a9e1b518fcbf4767646cd33d6894e38b9

  • SHA512

    f39f8fa9c31203a6fff5cf30f533c5c3ca8f68a9993f680131be6e3a843d61f609a455abb69686f7eba5cd96904908954c442743202920297a9649ff8c879126

  • SSDEEP

    6144:tCYfPnqFymR5uadElSdEi32oto3PZ3SZmRSu3G:UYnnqQmnu8kvimotKPZCZ6Su3G

Score
10/10
trickbotbankerdavediscoverytrojan

Malware Config

Targets

    • Target

      eec2a5cc875cd35d9334725f1a6f926c_JaffaCakes118

    • Size

      252KB

    • MD5

      eec2a5cc875cd35d9334725f1a6f926c

    • SHA1

      5ada78b6e5f667996a58246de1ad0453d6eff026

    • SHA256

      50709a83b665c2d2286d16395a93034a9e1b518fcbf4767646cd33d6894e38b9

    • SHA512

      f39f8fa9c31203a6fff5cf30f533c5c3ca8f68a9993f680131be6e3a843d61f609a455abb69686f7eba5cd96904908954c442743202920297a9649ff8c879126

    • SSDEEP

      6144:tCYfPnqFymR5uadElSdEi32oto3PZ3SZmRSu3G:UYnnqQmnu8kvimotKPZCZ6Su3G

    Score
    10/10
    trickbotbankerdavediscoverytrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Dave packer

      Detects executable using a packer named 'Dave' by the community, based on a string at the end.

      dave

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks