kpot | d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879 | Triage

Submit
Reports

Overview

overview

Static

static

d73e429471...79.exe

windows7-x64

d73e429471...79.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879
Size

1.2MB
Sample

240429-dbah8agc8w
MD5

1d62b885d9597161a953ded8be710ee2
SHA1

bef6de1ca41a6f883ea5c8a3e408ebb5e8c3e9fa
SHA256

d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879
SHA512

cecf62a6b20d48a7d7561dd5c5b639fc34ff1ec8a6f44cbf8f5f7155a02e51fe8dc62ee6c0acbda6468f51f6e5bd6c076cec3ce738538069c00ea564742d8823
SSDEEP

24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1SdrzRjVYaQ/n2lbcMfcF3:E5aIwC+Agr6S/FYqOc2W

Score

10^/10

kpot trickbot banker evasion stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879.exe

Resource

win7-20240419-en

kpot trickbot banker evasion stealer trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879.exe

Resource

win10v2004-20240419-en

kpot trickbot banker stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879
- Size
  
  1.2MB
- MD5
  
  1d62b885d9597161a953ded8be710ee2
- SHA1
  
  bef6de1ca41a6f883ea5c8a3e408ebb5e8c3e9fa
- SHA256
  
  d73e429471258f8adf2bd6349284bbc3a3f4ad87681d1d7fb0c93a029fcb5879
- SHA512
  
  cecf62a6b20d48a7d7561dd5c5b639fc34ff1ec8a6f44cbf8f5f7155a02e51fe8dc62ee6c0acbda6468f51f6e5bd6c076cec3ce738538069c00ea564742d8823
- SSDEEP
  
  24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1SdrzRjVYaQ/n2lbcMfcF3:E5aIwC+Agr6S/FYqOc2W
Score

10^/10

kpot trickbot banker evasion stealer trojan
- KPOT
  KPOT is an information stealer that steals user data and account credentials.
  trojan stealer kpot
- KPOT Core Executable
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Stops running service(s)
  evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

kpottrickbotbankerevasionstealertrojan

behavioral2

kpottrickbotbankerstealertrojan

© 2018-2025

Terms | Privacy