Extracted

• • Target

    fa04235f2c1acd6e551ec5ffecdcf71b_JaffaCakes118

  • Size

    299KB

  • MD5

    fa04235f2c1acd6e551ec5ffecdcf71b

  • SHA1

    3b7d78b3cf06f6b0caa20b7b8ae9dc395548a723

  • SHA256

    1e1cd8e03241b215e25e403ad23c5db674177c566ebd88ff665a1ec214f7e534

  • SHA512

    6d1ee393551222413f3f07252ef7201b51047ef4b76dd8cdc74e2477e3be784dd2866d17da2481c79945b9bb9574bf2a4a6a923c43d9cb4432dd6a814cf73c67

  • SSDEEP

    6144:HAemIDCLNJHnjIxTjJHfn0lkQGCXtZnALh7pBuc:g6KExT98lRXw7pB

  Score

  10^/10

  trickbotlib314bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot x86 loader

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2