Overview

overview

10

Static

static

10

b5405e989a...KI.exe

windows7-x64

10

b5405e989a...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5405e989aa2de26a5f40d60671e2fc0_NEIKI

  • Size

    1.1MB

  • Sample

    240508-dn1wyaff5z

  • MD5

    b5405e989aa2de26a5f40d60671e2fc0

  • SHA1

    586e458daf79bef6ae7ce85da6abf07f7c81622d

  • SHA256

    fb8001ca430aa77ad5855c489652b607ebd2f62447f2c381101d48d6d389b229

  • SHA512

    fd9a1aee373b645eb15d324247fdc1c8be45840b0967953c13a3fde56b5733e2192067bf2378190933912d2717c76a9407f4f866b3a6124f0295cca432a080a5

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/ZcnDPc2:E5aIwC+Agr6S/FFC+Lc2

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      b5405e989aa2de26a5f40d60671e2fc0_NEIKI

    • Size

      1.1MB

    • MD5

      b5405e989aa2de26a5f40d60671e2fc0

    • SHA1

      586e458daf79bef6ae7ce85da6abf07f7c81622d

    • SHA256

      fb8001ca430aa77ad5855c489652b607ebd2f62447f2c381101d48d6d389b229

    • SHA512

      fd9a1aee373b645eb15d324247fdc1c8be45840b0967953c13a3fde56b5733e2192067bf2378190933912d2717c76a9407f4f866b3a6124f0295cca432a080a5

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1StE10/ZcnDPc2:E5aIwC+Agr6S/FFC+Lc2

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks