kpot | dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a | Triage

Submit
Reports

Overview

overview

Static

static

dc63d4e8df...3a.exe

windows7-x64

dc63d4e8df...3a.exe

windows10-2004-x64

Sharing

General

Target

dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a
Size

1.1MB
Sample

240306-b9nsdsgh96
MD5

9c2921293ea9a983631841a66840face
SHA1

1f0ed5a37271c10c71b20ef5171dbb531f77fbb9
SHA256

dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a
SHA512

19c3f6e4a97570933930fd32c58e7f5fa31f1f894062e8e93436fefaf33d3c570ff8196ae1ade69ba309a22c6a8af3aa8f7c557aef316f760689ce3c6c15d003
SSDEEP

24576:zQ5aILMCfmAUjzX6xQGCZLFdGm13eia5G7y5R:E5aIwC+Agr6S/Fppa5Go

Score

10^/10

kpot trickbot banker evasion stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a.exe

Resource

win7-20240221-en

kpot trickbot banker evasion stealer trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a.exe

Resource

win10v2004-20240226-en

kpot trickbot banker stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a
- Size
  
  1.1MB
- MD5
  
  9c2921293ea9a983631841a66840face
- SHA1
  
  1f0ed5a37271c10c71b20ef5171dbb531f77fbb9
- SHA256
  
  dc63d4e8dfb5d58cd2d3e5f868c6525274321a51a6c81761c9d1e791e69a203a
- SHA512
  
  19c3f6e4a97570933930fd32c58e7f5fa31f1f894062e8e93436fefaf33d3c570ff8196ae1ade69ba309a22c6a8af3aa8f7c557aef316f760689ce3c6c15d003
- SSDEEP
  
  24576:zQ5aILMCfmAUjzX6xQGCZLFdGm13eia5G7y5R:E5aIwC+Agr6S/Fppa5Go
Score

10^/10

kpot trickbot banker evasion stealer trojan
- KPOT
  KPOT is an information stealer that steals user data and account credentials.
  trojan stealer kpot
- KPOT Core Executable
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

kpottrickbotbankerevasionstealertrojan

behavioral2

kpottrickbotbankerstealertrojan

© 2018-2025

Terms | Privacy