Overview

overview

10

Static

static

10

eac7a854d2...cs.exe

windows7-x64

10

eac7a854d2...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eac7a854d283ca1ad7d20226a79f9d90_NeikiAnalytics.exe

  • Size

    946KB

  • Sample

    240518-trd5cabh4s

  • MD5

    eac7a854d283ca1ad7d20226a79f9d90

  • SHA1

    1700165bfd27757db4a12ac0c3e531906c2d81d3

  • SHA256

    c1b9eb2b80e5768d0db6d135c38b77f266971a6df3dd6fffc5850b980214d8cc

  • SHA512

    b6791301ce2cc401322f6b7ab56624fabf3c7e142a34f00686c9ece5d17db963afc0944651ce64a868ed88b5de2607665058f50c897fd91db076792e63b35125

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6gfU1pjwjbsmQdmTYc:E5aIwC+Agr6g81pbc

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      eac7a854d283ca1ad7d20226a79f9d90_NeikiAnalytics.exe

    • Size

      946KB

    • MD5

      eac7a854d283ca1ad7d20226a79f9d90

    • SHA1

      1700165bfd27757db4a12ac0c3e531906c2d81d3

    • SHA256

      c1b9eb2b80e5768d0db6d135c38b77f266971a6df3dd6fffc5850b980214d8cc

    • SHA512

      b6791301ce2cc401322f6b7ab56624fabf3c7e142a34f00686c9ece5d17db963afc0944651ce64a868ed88b5de2607665058f50c897fd91db076792e63b35125

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6gfU1pjwjbsmQdmTYc:E5aIwC+Agr6g81pbc

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks