Overview

overview

10

Static

static

10

d36f1bad99...67.exe

windows7-x64

10

d36f1bad99...67.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d36f1bad99193e75baf894ab5b8cf038fa09e83cb76d3f64fdc94aa99e55c567

  • Size

    1.1MB

  • Sample

    240308-awef5aad82

  • MD5

    5c043010e04fc6dd7f7bbd2a702c9c94

  • SHA1

    d8cfd54ed6c55647a4660eba02e0af94dbe68b95

  • SHA256

    d36f1bad99193e75baf894ab5b8cf038fa09e83cb76d3f64fdc94aa99e55c567

  • SHA512

    3e8e3b2e2c4b034ac330f0a4511f0cf10704851dbb2e6e443dea1c2c0df642bb30d51c37e04830f25a17f3bdc28631e7c4451ae81f3c952dbe180ecbe67261b5

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOrwwyDTWOz6lL9reS5:E5aIwC+Agr6StVEnmcKrwwyGO+l9em

Score
10/10
kpottrickbotbankerevasionstealertrojan

Malware Config

Targets

    • Target

      d36f1bad99193e75baf894ab5b8cf038fa09e83cb76d3f64fdc94aa99e55c567

    • Size

      1.1MB

    • MD5

      5c043010e04fc6dd7f7bbd2a702c9c94

    • SHA1

      d8cfd54ed6c55647a4660eba02e0af94dbe68b95

    • SHA256

      d36f1bad99193e75baf894ab5b8cf038fa09e83cb76d3f64fdc94aa99e55c567

    • SHA512

      3e8e3b2e2c4b034ac330f0a4511f0cf10704851dbb2e6e443dea1c2c0df642bb30d51c37e04830f25a17f3bdc28631e7c4451ae81f3c952dbe180ecbe67261b5

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOrwwyDTWOz6lL9reS5:E5aIwC+Agr6StVEnmcKrwwyGO+l9em

    Score
    10/10
    kpottrickbotbankerevasionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks