Overview

overview

10

Static

static

10

1c69e70b5f...cs.exe

windows7-x64

10

1c69e70b5f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c69e70b5ffa89924323a5fd19e24a40_NeikiAnalytics

  • Size

    866KB

  • Sample

    240511-t758rsaf97

  • MD5

    1c69e70b5ffa89924323a5fd19e24a40

  • SHA1

    3b4609b2aef424a60af0e15257e276ebbdd602af

  • SHA256

    23a42d1d55ad6f396c76f4756f48e5d6628d8d917e46ebd2f8f9a7c49dd20e8f

  • SHA512

    53e922eff319803b422c16a31fe290305773954a382209703fe4c98bd10c3cf5ae592da2716642839343f0c0393ef00fe555958e64d76c3a19d419fdf04127e5

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSsGa60C+4PMAQNhW4LeZ:zQ5aILMCfmAUjzX6xQtjmsNLi

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      1c69e70b5ffa89924323a5fd19e24a40_NeikiAnalytics

    • Size

      866KB

    • MD5

      1c69e70b5ffa89924323a5fd19e24a40

    • SHA1

      3b4609b2aef424a60af0e15257e276ebbdd602af

    • SHA256

      23a42d1d55ad6f396c76f4756f48e5d6628d8d917e46ebd2f8f9a7c49dd20e8f

    • SHA512

      53e922eff319803b422c16a31fe290305773954a382209703fe4c98bd10c3cf5ae592da2716642839343f0c0393ef00fe555958e64d76c3a19d419fdf04127e5

    • SSDEEP

      12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSsGa60C+4PMAQNhW4LeZ:zQ5aILMCfmAUjzX6xQtjmsNLi

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks