Overview

overview

10

Static

static

10

4f27747d7d...cs.exe

windows7-x64

10

4f27747d7d...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f27747d7df889d180942f309bae0cd0_NeikiAnalytics.exe

  • Size

    1.2MB

  • Sample

    240529-le7xwsag83

  • MD5

    4f27747d7df889d180942f309bae0cd0

  • SHA1

    c4818a30a364e647374954411b9ca5cafd3b172d

  • SHA256

    39c47fe33430293ead5f9d17b897157b81a6879e4cbfdd0d8de08bbb9b818bfa

  • SHA512

    0c3113c3d8fdba0d90a91eed96e8de15565be9b8d08bc7059861734b3080fe1090ac1a0ed92f13be269b32e50176348c3f85d31a860ce3acd601640287279c31

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/TQyFV:E5aIwC+Agr6SqCPGvT/

Score
10/10
kpottrickbotbankerevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      4f27747d7df889d180942f309bae0cd0_NeikiAnalytics.exe

    • Size

      1.2MB

    • MD5

      4f27747d7df889d180942f309bae0cd0

    • SHA1

      c4818a30a364e647374954411b9ca5cafd3b172d

    • SHA256

      39c47fe33430293ead5f9d17b897157b81a6879e4cbfdd0d8de08bbb9b818bfa

    • SHA512

      0c3113c3d8fdba0d90a91eed96e8de15565be9b8d08bc7059861734b3080fe1090ac1a0ed92f13be269b32e50176348c3f85d31a860ce3acd601640287279c31

    • SSDEEP

      24576:zQ5aILMCfmAUjzX6xQE4efQg3zNn+2jsvercPk9N4hVI3/TQyFV:E5aIwC+Agr6SqCPGvT/

    Score
    10/10
    kpottrickbotbankerevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks