Overview

overview

10

Static

static

10

63ba3cb2d8...cs.exe

windows7-x64

10

63ba3cb2d8...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    63ba3cb2d8d590c68af1726d35711c50_NeikiAnalytics.exe

  • Size

    1.2MB

  • Sample

    240518-a75sfsca29

  • MD5

    63ba3cb2d8d590c68af1726d35711c50

  • SHA1

    4fb2567a06fa1eaaf9682f50c99ac2005adc7fa7

  • SHA256

    5f3df6cae6d1d10cc6cf0b6a07642077165cd8a70c6df3f4c84999cc6d036a38

  • SHA512

    a147f09f0046ad210e867ca1d76fa4f44b334ae59cb71bc7619e48d58ff6f4862713de5a48b3ab9b7bcacb54e7081f1325e5dd533a443126d3085c51dbe083fe

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwQREr0C:E5aIwC+Agr6S/FEAGsjiIIbErV

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      63ba3cb2d8d590c68af1726d35711c50_NeikiAnalytics.exe

    • Size

      1.2MB

    • MD5

      63ba3cb2d8d590c68af1726d35711c50

    • SHA1

      4fb2567a06fa1eaaf9682f50c99ac2005adc7fa7

    • SHA256

      5f3df6cae6d1d10cc6cf0b6a07642077165cd8a70c6df3f4c84999cc6d036a38

    • SHA512

      a147f09f0046ad210e867ca1d76fa4f44b334ae59cb71bc7619e48d58ff6f4862713de5a48b3ab9b7bcacb54e7081f1325e5dd533a443126d3085c51dbe083fe

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1Sd8zG7u75+FmVf6IIwQREr0C:E5aIwC+Agr6S/FEAGsjiIIbErV

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks