Overview

overview

10

Static

static

10

b474a43ea5...KI.exe

windows7-x64

10

b474a43ea5...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b474a43ea56fc721cf27927b4915fc80_NEIKI

  • Size

    1.3MB

  • Sample

    240508-p5dcrade2v

  • MD5

    b474a43ea56fc721cf27927b4915fc80

  • SHA1

    7bcaac40f65c0b6a779e7c7a433e5e3c573a71ca

  • SHA256

    41b15bae142cbf857b319a0251055e6d085bf48c18d19acc7f272bea2a9d7b9a

  • SHA512

    f57ccb09635bdc792342bb6a4089e8ec4d89b1f6cec6a69c07c0b95122f5d6604d94acbf73edd1c10c6ae6009f2b047286beae03afd0ebb02d27b1065370637c

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6gfU1pjwjbsXhmvZssrD+nRgnf4NvlOS5:E5aIwC+Agr6g81p1vsrNi5

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      b474a43ea56fc721cf27927b4915fc80_NEIKI

    • Size

      1.3MB

    • MD5

      b474a43ea56fc721cf27927b4915fc80

    • SHA1

      7bcaac40f65c0b6a779e7c7a433e5e3c573a71ca

    • SHA256

      41b15bae142cbf857b319a0251055e6d085bf48c18d19acc7f272bea2a9d7b9a

    • SHA512

      f57ccb09635bdc792342bb6a4089e8ec4d89b1f6cec6a69c07c0b95122f5d6604d94acbf73edd1c10c6ae6009f2b047286beae03afd0ebb02d27b1065370637c

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6gfU1pjwjbsXhmvZssrD+nRgnf4NvlOS5:E5aIwC+Agr6g81p1vsrNi5

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks