Overview

overview

10

Static

static

10

381b662e9f...cs.exe

windows7-x64

10

381b662e9f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    381b662e9f82d471b0e275cd8fea9320_NeikiAnalytics

  • Size

    946KB

  • Sample

    240511-zl3hmsbd59

  • MD5

    381b662e9f82d471b0e275cd8fea9320

  • SHA1

    3f9d247d046b22125dfe20f12e249de9f7c360a5

  • SHA256

    16b65998292d53e1f656132e730836b8f9c3d3356a01093c0f49e6661cfd8fc2

  • SHA512

    08f6c4bff75a447294cb44e49702e482bb930c976eeadc2fe1d3148d3daa7ddefbede71e9d023738fe8e45b77f252ac212b01aae3e373ff4af7e9042d02ed4fc

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUkhmZy:E5aIwC+Agr6SNbo

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      381b662e9f82d471b0e275cd8fea9320_NeikiAnalytics

    • Size

      946KB

    • MD5

      381b662e9f82d471b0e275cd8fea9320

    • SHA1

      3f9d247d046b22125dfe20f12e249de9f7c360a5

    • SHA256

      16b65998292d53e1f656132e730836b8f9c3d3356a01093c0f49e6661cfd8fc2

    • SHA512

      08f6c4bff75a447294cb44e49702e482bb930c976eeadc2fe1d3148d3daa7ddefbede71e9d023738fe8e45b77f252ac212b01aae3e373ff4af7e9042d02ed4fc

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUkhmZy:E5aIwC+Agr6SNbo

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks