Overview

overview

10

Static

static

10

NEAS.9fbcc...60.exe

windows7-x64

10

NEAS.9fbcc...60.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.9fbcc05219f22a2f6d651bf6821c6f60.exe

  • Size

    1016KB

  • Sample

    231021-1a3vpshe85

  • MD5

    9fbcc05219f22a2f6d651bf6821c6f60

  • SHA1

    3b5dff4c7f4c238fcdd62cd5c30e76fb855c2579

  • SHA256

    92a01e740639aaa4dfb9d4c67357aa6b7595c4e1d8618c3a2aca94efe8097b4a

  • SHA512

    3d269246c97bf34c8ca06f6204b7127c580fea81d46fc9f63d7cbfd23a0c2e42f6fde499d2f7f4010d1408fb75e19a2b1992a240718f5bd8fde4aec9628c63c6

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQtpj/Yz6tGg1ZGUl:E5aIwC+Agr6St1tR3

Score
10/10
kpottrickbotbankerevasionstealertrojan

Malware Config

Targets

    • Target

      NEAS.9fbcc05219f22a2f6d651bf6821c6f60.exe

    • Size

      1016KB

    • MD5

      9fbcc05219f22a2f6d651bf6821c6f60

    • SHA1

      3b5dff4c7f4c238fcdd62cd5c30e76fb855c2579

    • SHA256

      92a01e740639aaa4dfb9d4c67357aa6b7595c4e1d8618c3a2aca94efe8097b4a

    • SHA512

      3d269246c97bf34c8ca06f6204b7127c580fea81d46fc9f63d7cbfd23a0c2e42f6fde499d2f7f4010d1408fb75e19a2b1992a240718f5bd8fde4aec9628c63c6

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQtpj/Yz6tGg1ZGUl:E5aIwC+Agr6St1tR3

    Score
    10/10
    kpottrickbotbankerevasionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks