Overview

overview

10

Static

static

10

259b731e27...b7.exe

windows7-x64

10

259b731e27...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    259b731e27ccc3512e6ba8a4ac31cc7c7266ba2675cb25e61b6127ed51857cb7

  • Size

    1.0MB

  • Sample

    240517-yd85safd5y

  • MD5

    647fa2e74165743306ed5a8a79d4758f

  • SHA1

    3e55567ced75c611ea19a23bb6c893ae34080a50

  • SHA256

    259b731e27ccc3512e6ba8a4ac31cc7c7266ba2675cb25e61b6127ed51857cb7

  • SHA512

    da33a72f52fd71210e3d80d322d61524dc41c311553700b9a41f66a3958b54e07798c22aa892c3b7bdcc851b123a578b37ec048d9da64e9d2a43afbe5d7258f6

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSM64:E5aIwC+Agr6SNJ

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      259b731e27ccc3512e6ba8a4ac31cc7c7266ba2675cb25e61b6127ed51857cb7

    • Size

      1.0MB

    • MD5

      647fa2e74165743306ed5a8a79d4758f

    • SHA1

      3e55567ced75c611ea19a23bb6c893ae34080a50

    • SHA256

      259b731e27ccc3512e6ba8a4ac31cc7c7266ba2675cb25e61b6127ed51857cb7

    • SHA512

      da33a72f52fd71210e3d80d322d61524dc41c311553700b9a41f66a3958b54e07798c22aa892c3b7bdcc851b123a578b37ec048d9da64e9d2a43afbe5d7258f6

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSM64:E5aIwC+Agr6SNJ

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks