Extracted

• • Target

    566e13e8c5d8ed5c97d9162c4c6ba5d0_JaffaCakes118

  • Size

    332KB

  • MD5

    566e13e8c5d8ed5c97d9162c4c6ba5d0

  • SHA1

    f09dbdba1c53a02c416620c9ca07f7e517076677

  • SHA256

    d3bb47fb961a415f8adc37b8154c42ee2214cd81c8fcb56982980eacd3b6ea86

  • SHA512

    13a75d9875ca31a67401470228f9aba44cbb5883d8692ca193b6b3eef8f6e7777f461df2ee53a4a8de986116bb857672684ed16e7d416efaae83fc1bf2a8d972

  • SSDEEP

    6144:50Xc85ziBHz6lDiBo8jcdMheQ/Qj4tcmMpcG3C6YFlfTNU:50XciziBT6u3YdM0Ae41MpcG3Q6

  Score

  10^/10

  trickbotlib359bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2