kpot | d28c7924207265696e0f26eff973ee0d62a7d1e5f1ef40cd2b8370229f82c531 | Triage

Resubmissions

16-08-2024 07:38

240816-jgl24asfrc 10

Sharing

General

Target

2080afbfc15875a28fb023e5e9b79d50N.exe
Size

870KB
Sample

240816-jgl24asfrc
MD5

2080afbfc15875a28fb023e5e9b79d50
SHA1

74563a45da5b7208a0dffe8a9e083ea580b977fd
SHA256

d28c7924207265696e0f26eff973ee0d62a7d1e5f1ef40cd2b8370229f82c531
SHA512

9e70441f746cb77eb3dfb6d004f09bf2339408bc8b2f22003bed4ac6d90ae46e18748a9c9f677ce73e6f4a981bc7537defbc2c8ea626a48ea199230f7f620409
SSDEEP

12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8Glwmk:zQ5aILMCfmAUjzX6xQGCZLFdGm13Jwmk

Score

10^/10

kpot trickbot banker discovery evasion execution stealer trojan

Malware Config

Targets

- Target
  
  2080afbfc15875a28fb023e5e9b79d50N.exe
- Size
  
  870KB
- MD5
  
  2080afbfc15875a28fb023e5e9b79d50
- SHA1
  
  74563a45da5b7208a0dffe8a9e083ea580b977fd
- SHA256
  
  d28c7924207265696e0f26eff973ee0d62a7d1e5f1ef40cd2b8370229f82c531
- SHA512
  
  9e70441f746cb77eb3dfb6d004f09bf2339408bc8b2f22003bed4ac6d90ae46e18748a9c9f677ce73e6f4a981bc7537defbc2c8ea626a48ea199230f7f620409
- SSDEEP
  
  12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQGCsksQjn6YHldGm1ufSD8Glwmk:zQ5aILMCfmAUjzX6xQGCZLFdGm13Jwmk
Score

10^/10

kpot trickbot banker discovery evasion execution stealer trojan
- KPOT
  KPOT is an information stealer that steals user data and account credentials.
  trojan stealer kpot
- KPOT Core Executable
- Trickbot
  Developed in 2016, TrickBot is one of the more recent banking Trojans.
  trojan banker trickbot
- Trickbot x86 loader
  Detected Trickbot's x86 loader that unpacks the x86 payload.
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

kpottrickbotbankerdiscoveryevasionexecutionstealertrojan

behavioral2

kpottrickbotbankerdiscoverystealertrojan