Overview

overview

10

Static

static

10

e0e45ed367...76.exe

windows7-x64

10

e0e45ed367...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876

  • Size

    1.0MB

  • Sample

    240526-ejrcdaeh28

  • MD5

    075871f9bc9e82f769ac26bb9c6fb6b3

  • SHA1

    9ac632584d336b025130af45da627c1c0bd68ba2

  • SHA256

    e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876

  • SHA512

    90a4089cf25493f7d0489caa0ee93b96cbac9e15d2596f1f7a03ec1e59c3dd85a63ea6a4c7cf9b40cbea87d15b0884c442f75a33cce53d6619bb33375f99b3f1

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9CT6:E5aIwC+Agr6SNass

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876

    • Size

      1.0MB

    • MD5

      075871f9bc9e82f769ac26bb9c6fb6b3

    • SHA1

      9ac632584d336b025130af45da627c1c0bd68ba2

    • SHA256

      e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876

    • SHA512

      90a4089cf25493f7d0489caa0ee93b96cbac9e15d2596f1f7a03ec1e59c3dd85a63ea6a4c7cf9b40cbea87d15b0884c442f75a33cce53d6619bb33375f99b3f1

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9CT6:E5aIwC+Agr6SNass

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks