Overview

overview

10

Static

static

10

eb2bb9df20...cs.exe

windows7-x64

10

eb2bb9df20...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb2bb9df20395e49df2ddd2fabd40b60_NeikiAnalytics

  • Size

    912KB

  • Sample

    240509-y4jykscf6w

  • MD5

    eb2bb9df20395e49df2ddd2fabd40b60

  • SHA1

    b4d07606fc61b8aa01157429d4437c6e46f44381

  • SHA256

    021963f3c5510d0bebd59ba4e9adb52207c18833f71d873e6bbdcb337070bcec

  • SHA512

    d84812197075f51d169f0511a600685aea2e7411db1416cb6226f4148e76505993e4a8abd1891ec12131a7c0d8d2b36d106a66f7a14d7f6c1137e53b61453e37

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4EnpZgkJOSSkW:E5aIwC+Agr6StVEn0ksb

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      eb2bb9df20395e49df2ddd2fabd40b60_NeikiAnalytics

    • Size

      912KB

    • MD5

      eb2bb9df20395e49df2ddd2fabd40b60

    • SHA1

      b4d07606fc61b8aa01157429d4437c6e46f44381

    • SHA256

      021963f3c5510d0bebd59ba4e9adb52207c18833f71d873e6bbdcb337070bcec

    • SHA512

      d84812197075f51d169f0511a600685aea2e7411db1416cb6226f4148e76505993e4a8abd1891ec12131a7c0d8d2b36d106a66f7a14d7f6c1137e53b61453e37

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQt+4EnpZgkJOSSkW:E5aIwC+Agr6StVEn0ksb

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks