kpot | 9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df | Triage

Submit
Reports

Overview

overview

Static

static

9c7c25055d...df.exe

windows7-x64

9c7c25055d...df.exe

windows10-2004-x64

Sharing

General

Target

9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df
Size

1002KB
Sample

240602-aym62sdb89
MD5

8b532e3a92eb3dc5f617ac5380ea8767
SHA1

d9f36a0d5bf4b024f14740db2a679f05ac195be5
SHA256

9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df
SHA512

a1f8463d78b529894e14ef2a9ddb666a32eceb53fe3d91493e49965ed6295492dfd257f8ffa55a97de16d5b1283ed689dfac4e7830ff1dc6c8f6abdce4053160
SSDEEP

24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9C:E5aIwC+Agr6SNas3

Score

10^/10

kpot trickbot banker evasion execution stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df.exe

Resource

win7-20240419-en

kpot trickbot banker evasion execution stealer trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df.exe

Resource

win10v2004-20240508-en

kpot trickbot banker stealer trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df
- Size
  
  1002KB
- MD5
  
  8b532e3a92eb3dc5f617ac5380ea8767
- SHA1
  
  d9f36a0d5bf4b024f14740db2a679f05ac195be5
- SHA256
  
  9c7c25055db19708c4cd137c67c1c569fad69e37bb86263d46dbe54fbb3cd2df
- SHA512
  
  a1f8463d78b529894e14ef2a9ddb666a32eceb53fe3d91493e49965ed6295492dfd257f8ffa55a97de16d5b1283ed689dfac4e7830ff1dc6c8f6abdce4053160
- SSDEEP
  
  24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9C:E5aIwC+Agr6SNas3
Score

10^/10

kpot trickbot banker evasion execution stealer trojan
- KPOT
  KPOT is an information stealer that steals user data and account credentials.
  trojan stealer kpot
- KPOT Core Executable
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

kpottrickbotbankerevasionexecutionstealertrojan

behavioral2

kpottrickbotbankerstealertrojan

© 2018-2025

Terms | Privacy