Overview

overview

10

Static

static

10

9e4c13e338...cs.exe

windows7-x64

10

9e4c13e338...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9e4c13e338b107a623c37832a114df80_NeikiAnalytics

  • Size

    1.2MB

  • Sample

    240510-h473eadc66

  • MD5

    9e4c13e338b107a623c37832a114df80

  • SHA1

    95c99d23b7d2d5bd2a6c7b46d660794d4ae4f693

  • SHA256

    591fc7aae67312cbec763b3c97140d812e49a492a66c4f25068897a85b34ff3c

  • SHA512

    13fafb62156ddae44673028b50fe03650697dc1daf978cbfaa3dc4ea7e0df075b38848aaee68a3eaaf6df5fa3ff1c57407b176e3969d6f70e8726e0f71f518b4

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsA7svY3qbuoVikIXe:E5aIwC+Agr6SNv/Ikee

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      9e4c13e338b107a623c37832a114df80_NeikiAnalytics

    • Size

      1.2MB

    • MD5

      9e4c13e338b107a623c37832a114df80

    • SHA1

      95c99d23b7d2d5bd2a6c7b46d660794d4ae4f693

    • SHA256

      591fc7aae67312cbec763b3c97140d812e49a492a66c4f25068897a85b34ff3c

    • SHA512

      13fafb62156ddae44673028b50fe03650697dc1daf978cbfaa3dc4ea7e0df075b38848aaee68a3eaaf6df5fa3ff1c57407b176e3969d6f70e8726e0f71f518b4

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsA7svY3qbuoVikIXe:E5aIwC+Agr6SNv/Ikee

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks