Overview

overview

10

Static

static

10

0f3410be43...KI.exe

windows7-x64

10

0f3410be43...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f3410be43bd9139997b53dc571304b0_NEIKI

  • Size

    1002KB

  • Sample

    240508-xhe7tscd43

  • MD5

    0f3410be43bd9139997b53dc571304b0

  • SHA1

    cb2e743d8254185d7bec6b3ae6af6312d4e0e835

  • SHA256

    be8e046a55140023cef54bd6bdd1c8a089be2abd0375265e0c110c58a0874a83

  • SHA512

    96140ab4e9c10cf81d55060c9a58d49338e60d0caf11a1a55d21f97a9e901541acb6bfaed5dfbcbf1c2050407b10ce88b08bda478be98b820c9849f140701c05

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSsfUhQEsBLKR0ox5r93g1aKs2lyLU:zQ5aILMCfmAUjzX6xQtNBMtOFsXS

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      0f3410be43bd9139997b53dc571304b0_NEIKI

    • Size

      1002KB

    • MD5

      0f3410be43bd9139997b53dc571304b0

    • SHA1

      cb2e743d8254185d7bec6b3ae6af6312d4e0e835

    • SHA256

      be8e046a55140023cef54bd6bdd1c8a089be2abd0375265e0c110c58a0874a83

    • SHA512

      96140ab4e9c10cf81d55060c9a58d49338e60d0caf11a1a55d21f97a9e901541acb6bfaed5dfbcbf1c2050407b10ce88b08bda478be98b820c9849f140701c05

    • SSDEEP

      12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSsfUhQEsBLKR0ox5r93g1aKs2lyLU:zQ5aILMCfmAUjzX6xQtNBMtOFsXS

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks