Extracted

• • Target

    f9f52a1269c9577937cb222ac8037214_JaffaCakes118

  • Size

    568KB

  • MD5

    f9f52a1269c9577937cb222ac8037214

  • SHA1

    63d8fc56792332a69b844101ee4c4a1b58608e2d

  • SHA256

    2c69ee71a37c1e3e195ba454e6728da0f41fc16c173a056df99916ceb5b51e41

  • SHA512

    36bcafb61e105ce2a36e9509b374b95cfd8b15dd20ff31ebf40b6a691c7f7bf494fbdd12deac202e33bd23f325e9b5e6e6a7634f20e124ba6319b9d88b95fe16

  • SSDEEP

    6144:VdjTOk2ikl/LmnxyJjvRn9tAdadrEhcVKFNTOYNSeA/GjaMwZTazWXzkYdehtXIT:fObZ5ayNl/9ucVJYNSegGjzs4x/Y

  Score

  10^/10

  trickbotbankerdiscoveryevasionexecutiontrojanser0827us

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2