Extracted

• • Target

    b682c3220977589e57e52db385c538f9_JaffaCakes118

  • Size

    332KB

  • MD5

    b682c3220977589e57e52db385c538f9

  • SHA1

    dc704cb2e1bbca69e3d068b3e630af3c2745dd70

  • SHA256

    ef5a54d5db53b4048dddc782c78f7afc2d66a2f24e480d91be9c9a96d085f117

  • SHA512

    5353079e086130e9408ecbf18b391fd709f903cba03fc0dbead335b2fdebad3e07093d852d6f4ba03d8f1147531c14ff2129b9cb81e15317fe3c2c0c222cc3aa

  • SSDEEP

    6144:5fjz/OEjZzrjhHqbabslnCfyytYQg9rLJmQkdFLT9yx/0+zN6:5ff/blHK4s0yuZgZJmQk7tyZ0+A

  Score

  10^/10

  trickbottot359bankerdiscoveryevasionexecutiontrojanpersistence

  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

    trojanbankertrickbot

  • Trickbot family

    trickbot

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2