Overview

overview

10

Static

static

10

e1caefc11f...cs.exe

windows7-x64

10

e1caefc11f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe

  • Size

    1.2MB

  • Sample

    240526-pds9wsca97

  • MD5

    e1caefc11f36048b4d3998e26c0c8140

  • SHA1

    80d82492c25fe821f589d211d324bf05d18b399d

  • SHA256

    25a424ecc5f426c420bce4c5ae1814bc5b705d2e1d453c25b8d4631ea5608a6d

  • SHA512

    30dd8ad9bf4b8f6af32dfcace79dbe1f2eddd62c908cdc4f6d5baca419ccfb529d7857063d5a00addc5fae999b3bf5e262a52d01afdbb1523c87d918fc657ff3

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wn+q:E5aIwC+Agr6StVEnmcKxY/O1pq

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      e1caefc11f36048b4d3998e26c0c8140_NeikiAnalytics.exe

    • Size

      1.2MB

    • MD5

      e1caefc11f36048b4d3998e26c0c8140

    • SHA1

      80d82492c25fe821f589d211d324bf05d18b399d

    • SHA256

      25a424ecc5f426c420bce4c5ae1814bc5b705d2e1d453c25b8d4631ea5608a6d

    • SHA512

      30dd8ad9bf4b8f6af32dfcace79dbe1f2eddd62c908cdc4f6d5baca419ccfb529d7857063d5a00addc5fae999b3bf5e262a52d01afdbb1523c87d918fc657ff3

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51Wn+q:E5aIwC+Agr6StVEnmcKxY/O1pq

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks