Overview

overview

10

Static

static

10

3b239e2c35...cs.exe

windows7-x64

10

3b239e2c35...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b239e2c35c2426c3240eae9dcb15220_NeikiAnalytics

  • Size

    1.2MB

  • Sample

    240509-p7t4aaaf6s

  • MD5

    3b239e2c35c2426c3240eae9dcb15220

  • SHA1

    b7764e02eceb218027227896497ea80804eefe19

  • SHA256

    1f022d46391a9f239e614e7494be6eb864815038488f4a5cfb2f2a486c601dfe

  • SHA512

    b3988a9099957e7fcb9cc323a3b0073db94cad60eec6df3a555dd03cfbe90f2e20dd704c9d14d7b9bd33e4f83eed551f69e2ce97131ba4436e302825ec4f3043

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6gfU1pjwjbsXhmvZssrD++jUeCblAxgwaWG:E5aIwC+Agr6g81p1vsrXCxt3

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      3b239e2c35c2426c3240eae9dcb15220_NeikiAnalytics

    • Size

      1.2MB

    • MD5

      3b239e2c35c2426c3240eae9dcb15220

    • SHA1

      b7764e02eceb218027227896497ea80804eefe19

    • SHA256

      1f022d46391a9f239e614e7494be6eb864815038488f4a5cfb2f2a486c601dfe

    • SHA512

      b3988a9099957e7fcb9cc323a3b0073db94cad60eec6df3a555dd03cfbe90f2e20dd704c9d14d7b9bd33e4f83eed551f69e2ce97131ba4436e302825ec4f3043

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6gfU1pjwjbsXhmvZssrD++jUeCblAxgwaWG:E5aIwC+Agr6g81p1vsrXCxt3

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks