Overview

overview

10

Static

static

10

4052f1234b...cs.exe

windows7-x64

10

4052f1234b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4052f1234ba1347a9b19b4e118b2a120_NeikiAnalytics.exe

  • Size

    1.2MB

  • Sample

    240529-feb8bsah4y

  • MD5

    4052f1234ba1347a9b19b4e118b2a120

  • SHA1

    99b87ea06a5fb21426f7209ac8962a7ed10c33f0

  • SHA256

    162be35289daca8688df1a6465ea52fb5d2b97ed09f08cc718977384ab5a6e6f

  • SHA512

    ff0212748ad6ac013bd4bb70f02cfd333efbd66777262aa34afb9e00d890f0a343227e3d2cb517d2c08ec327ad51231c07a7a47f6d87a2f5440c7c6d06d0f053

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/TQyFqsM:E5aIwC+Agr6SqCPGvTTM

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      4052f1234ba1347a9b19b4e118b2a120_NeikiAnalytics.exe

    • Size

      1.2MB

    • MD5

      4052f1234ba1347a9b19b4e118b2a120

    • SHA1

      99b87ea06a5fb21426f7209ac8962a7ed10c33f0

    • SHA256

      162be35289daca8688df1a6465ea52fb5d2b97ed09f08cc718977384ab5a6e6f

    • SHA512

      ff0212748ad6ac013bd4bb70f02cfd333efbd66777262aa34afb9e00d890f0a343227e3d2cb517d2c08ec327ad51231c07a7a47f6d87a2f5440c7c6d06d0f053

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/TQyFqsM:E5aIwC+Agr6SqCPGvTTM

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks