Overview

overview

10

Static

static

3

fb48c7e048...18.exe

windows7-x64

10

fb48c7e048...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb48c7e0484133a84f8d4546da134a68_JaffaCakes118

  • Size

    443KB

  • Sample

    240928-cd9westcqc

  • MD5

    fb48c7e0484133a84f8d4546da134a68

  • SHA1

    e9e35fa02654e02529b09389fe6f5f53480291f8

  • SHA256

    87ee9da95af924cb7cd7e8c3acdbc952b46377a8d0eb2150dfdab35def82ba51

  • SHA512

    ed9b28f75b7ee12c197bf7a3ef11d3bc05bd1b3ec484ec209e5d30fa751be61e7aab39177b89725f2ce8007c99f82cdf543d2b138958ca12c61bb0eb4efe7513

  • SSDEEP

    6144:f6ohM6XPOgAtlBxp++UwmidmDzqQ/ZhAcOiu+b53l/15:fBhhPktlXpsw74DZvpzfn

Score
10/10
trickbotbankerdiscoveryevasionexecutiontrojan

Malware Config

Targets

    • Target

      fb48c7e0484133a84f8d4546da134a68_JaffaCakes118

    • Size

      443KB

    • MD5

      fb48c7e0484133a84f8d4546da134a68

    • SHA1

      e9e35fa02654e02529b09389fe6f5f53480291f8

    • SHA256

      87ee9da95af924cb7cd7e8c3acdbc952b46377a8d0eb2150dfdab35def82ba51

    • SHA512

      ed9b28f75b7ee12c197bf7a3ef11d3bc05bd1b3ec484ec209e5d30fa751be61e7aab39177b89725f2ce8007c99f82cdf543d2b138958ca12c61bb0eb4efe7513

    • SSDEEP

      6144:f6ohM6XPOgAtlBxp++UwmidmDzqQ/ZhAcOiu+b53l/15:fBhhPktlXpsw74DZvpzfn

    Score
    10/10
    trickbotbankerdiscoveryevasionexecutiontrojan

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks