Overview

overview

10

Static

static

10

5cfa4b705d...AS.exe

windows7-x64

10

5cfa4b705d...AS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5cfa4b705d88c768400fa4c88396f120_NEAS

  • Size

    1.3MB

  • Sample

    240507-d557zsgc9x

  • MD5

    5cfa4b705d88c768400fa4c88396f120

  • SHA1

    deff2c89ada55dd327743b92f3e764098f8d9dcb

  • SHA256

    dbb838e53fb35c86e03a4d1e8fdf200ec6b4d102c7654f1c7dc9514ae61eacbe

  • SHA512

    421b54eae382e5b9bff9e4bf32080ce1c8b006d09d5d9bea2842dea8f7bb99b13107a682c0cc38128c383e9cf5f4e36a3888f2a52dea89b6e50abb0e1796ae40

  • SSDEEP

    24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQU:E5aIwC+Agr6twjVDF

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      5cfa4b705d88c768400fa4c88396f120_NEAS

    • Size

      1.3MB

    • MD5

      5cfa4b705d88c768400fa4c88396f120

    • SHA1

      deff2c89ada55dd327743b92f3e764098f8d9dcb

    • SHA256

      dbb838e53fb35c86e03a4d1e8fdf200ec6b4d102c7654f1c7dc9514ae61eacbe

    • SHA512

      421b54eae382e5b9bff9e4bf32080ce1c8b006d09d5d9bea2842dea8f7bb99b13107a682c0cc38128c383e9cf5f4e36a3888f2a52dea89b6e50abb0e1796ae40

    • SSDEEP

      24576:zQ5aILMCfmAUjzX677WOMc7qzz1IojVD0UOSQU:E5aIwC+Agr6twjVDF

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks