Overview

overview

10

Static

static

10

0046319b1b...cs.exe

windows7-x64

10

0046319b1b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0046319b1b69020c6c97c54d83068b20_NeikiAnalytics.exe

  • Size

    1013KB

  • Sample

    240526-p8mqlaef8w

  • MD5

    0046319b1b69020c6c97c54d83068b20

  • SHA1

    921a0e9e79a83333706aad88aa398861546a4eb9

  • SHA256

    fa1025536221146c61f0a1fed726a761a262bd80cc3ed892e995f559a7e7fadb

  • SHA512

    65c2169ece1c25aae51a03ba81c60fd67e1e1b834c0a70d036fb5640f67d0d606d93f7885d3f25bab81653fc000fe5eade3089d6d7257d47f4089b70b2551ed8

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVfC:zQ5aILMCfmAUjzX6T0TlOnvPyQCfC

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      0046319b1b69020c6c97c54d83068b20_NeikiAnalytics.exe

    • Size

      1013KB

    • MD5

      0046319b1b69020c6c97c54d83068b20

    • SHA1

      921a0e9e79a83333706aad88aa398861546a4eb9

    • SHA256

      fa1025536221146c61f0a1fed726a761a262bd80cc3ed892e995f559a7e7fadb

    • SHA512

      65c2169ece1c25aae51a03ba81c60fd67e1e1b834c0a70d036fb5640f67d0d606d93f7885d3f25bab81653fc000fe5eade3089d6d7257d47f4089b70b2551ed8

    • SSDEEP

      12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEs1HzCHT4TlM9YmJ2Q97v54yRnkQgVfC:zQ5aILMCfmAUjzX6T0TlOnvPyQCfC

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks