Overview

overview

10

Static

static

10

1840f2569b...cs.exe

windows7-x64

10

1840f2569b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1840f2569b520d7507dd1bc120674450_NeikiAnalytics

  • Size

    885KB

  • Sample

    240511-tjtj3aef8v

  • MD5

    1840f2569b520d7507dd1bc120674450

  • SHA1

    8cd79cd0eb32e4dd98af34edc11be15e724fa0eb

  • SHA256

    283dad82e2073695c6e9a69d2550d8bdc7041a9eb0997b835458714c7e2619f8

  • SHA512

    246d48541dee022c773f598cc9841fdb0ec2f8f48981d5868068132c4a7eb2673b789945e16a4b2cc9ba2bcaa5872d94552235255382eb5374dc1e168b114979

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4EnpZgkJOSSkd:E5aIwC+Agr6StVEn0ksM

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      1840f2569b520d7507dd1bc120674450_NeikiAnalytics

    • Size

      885KB

    • MD5

      1840f2569b520d7507dd1bc120674450

    • SHA1

      8cd79cd0eb32e4dd98af34edc11be15e724fa0eb

    • SHA256

      283dad82e2073695c6e9a69d2550d8bdc7041a9eb0997b835458714c7e2619f8

    • SHA512

      246d48541dee022c773f598cc9841fdb0ec2f8f48981d5868068132c4a7eb2673b789945e16a4b2cc9ba2bcaa5872d94552235255382eb5374dc1e168b114979

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQt+4EnpZgkJOSSkd:E5aIwC+Agr6StVEn0ksM

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks