Overview

overview

10

Static

static

10

6aa56c8f91...0N.exe

windows7-x64

10

6aa56c8f91...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6aa56c8f915c15b7d4a9aab9e30af870N.exe

  • Size

    861KB

  • Sample

    240807-fs1g3ssaqp

  • MD5

    6aa56c8f915c15b7d4a9aab9e30af870

  • SHA1

    66cd3ad17fa323d51f00ce852cbd3266b28c42ad

  • SHA256

    4a70b3600618e9f49c0c952e7a09115e57c72d8c304384363d0dbab46eef2f3a

  • SHA512

    c0357c25a4d3b8a32b5baadd3708787eb6486f5dd185b6b42c9431cc9bfbc02ee184f528dcfb102dbd91a6fd1346f21257b5e2a7dd3ae65beaa729c1eabf8cc2

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8Gl/ht:zQ5aILMCfmAUjzX6xQGCZLFdGm13J/ht

Score
10/10
kpottrickbotbankerdiscoveryevasionexecutionstealertrojan

Malware Config

Targets

    • Target

      6aa56c8f915c15b7d4a9aab9e30af870N.exe

    • Size

      861KB

    • MD5

      6aa56c8f915c15b7d4a9aab9e30af870

    • SHA1

      66cd3ad17fa323d51f00ce852cbd3266b28c42ad

    • SHA256

      4a70b3600618e9f49c0c952e7a09115e57c72d8c304384363d0dbab46eef2f3a

    • SHA512

      c0357c25a4d3b8a32b5baadd3708787eb6486f5dd185b6b42c9431cc9bfbc02ee184f528dcfb102dbd91a6fd1346f21257b5e2a7dd3ae65beaa729c1eabf8cc2

    • SSDEEP

      12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8Gl/ht:zQ5aILMCfmAUjzX6xQGCZLFdGm13J/ht

    Score
    10/10
    kpottrickbotbankerdiscoveryevasionexecutionstealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

      trojanbankertrickbot

    • Trickbot x86 loader

      Detected Trickbot's x86 loader that unpacks the x86 payload.

    • Stops running service(s)

      evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks