MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e
SHA3-384 hash: b7c126cd5cdd471c67c39e9417591d872733e0d99ba1ad93f77758f9c54b6dc6426d1007a6c2ed96b1db5f6845eebe14
SHA1 hash: a5de5f110aadc1693b9705ef9496a81f0c721f9b
MD5 hash: a4c7348870f5652c4c19c2d4a95cf43c
humanhash: lithium-moon-carpet-pennsylvania
File name:a4c7348870f5652c4c19c2d4a95cf43c.exe
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:406'016 bytes
First seen:2021-08-25 05:39:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3bdc58d7d3add14fdfc74404aa032a2d (7 x RaccoonStealer, 3 x RedLineStealer, 2 x CoinMiner)
ssdeep 6144:4Uu7BQTBcpdBo3kRGwGReyEqV5l6hTKbU2rVXwRlCF7e8bEcxb:4LQ9oM+srzghZlCHEcF
Threatray 56 similar samples on MalwareBazaar
TLSH T16884F1003670C537C466067089D3DBB0E62C7646AE759547BBE4AEEF2EB12D0763A3C9
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a4c7348870f5652c4c19c2d4a95cf43c.exe
Verdict:
Malicious activity
Analysis date:
2021-08-25 05:54:37 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9085754b-669f-4039-a930-7e45521fbbb3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182169/
Detection(s):
SecuriteInfo.com.BackDoor.Siggen2.3559.3670.20915.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/594884e9-136c-4513-b185-0cfc02004bf2
Result
Threat name:
KPot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/838723
Signature
Contains VNC / remote desktop functionality (version string found)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected KPot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 471151 Sample: DS1GhEvDgN.exe Startdate: 25/08/2021 Architecture: WINDOWS Score: 100 51 kpotuvorot10.bit 2->51 53 gorokborotun782699.com 2->53 55 ebanat6977769.com 2->55 65 Multi AV Scanner detection for submitted file 2->65 67 Yara detected KPot 2->67 69 Machine Learning detection for sample 2->69 71 Contains VNC / remote desktop functionality (version string found) 2->71 8 DS1GhEvDgN.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        signatures3 process4 file5 43 C:\ProgramData\...\33A2E4F0.exe, PE32 8->43 dropped 73 Detected unpacking (changes PE section rights) 8->73 75 Creates autostart registry keys with suspicious names 8->75 16 33A2E4F0.exe 8->16         started        signatures6 process7 dnsIp8 45 45.56.79.23, 49714, 49715, 49716 LINODE-APLinodeLLCUS United States 16->45 47 gorokborotun782699.com 72.14.185.43, 49713, 49717, 49719 LINODE-APLinodeLLCUS United States 16->47 49 3 other IPs or domains 16->49 57 Multi AV Scanner detection for dropped file 16->57 59 Detected unpacking (changes PE section rights) 16->59 61 Machine Learning detection for dropped file 16->61 63 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 16->63 20 WerFault.exe 9 16->20         started        23 WerFault.exe 9 16->23         started        25 WerFault.exe 9 16->25         started        27 4 other processes 16->27 signatures9 process10 file11 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 23->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 25->33 dropped 35 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->35 dropped 37 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->37 dropped 39 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->39 dropped 41 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 27->41 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 19:37:00 UTC
AV detection:
27 of 46 (58.70%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
32e30f494b7bb01ab18836029193c2a79fb63795f978eeed31103f368c6d8fba
KPOTStealer
34b5873621d4f24ea1ff0f45d19e4f0b448febc8a23997e1e52a6e4815d6af89
KPOTStealer
35f0fd2e322b088525d860105208e5cdd39f85b0016b56d9e76cff8bbc542179
KPOTStealer
74e82ea63f25fdb065ab8d4df1d69f9a22d1c1a76edf609f2f22d5080411fe4c
KPOTStealer
94198327544af310a9c7911096baa5cbf6fe5d02e2b0ba452082ecbc3a67543a
KPOTStealer
9f3805a821c12122b67395c50e390d35c70e83d5b82a6e5741e56c0087960a60
KPOTStealer
bd6407bd4b93629025d0ba89fb1f0dd257c6d8f79b59138584fa8f6fd8d71d44
KPOTStealer
f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160
KPOTStealer
+ 46 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210825-7wxw99mfxn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/5ccb1014-c02f-45fd-b4be-895b9ac7df84/
SH256 hash:
20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e
MD5 hash:
a4c7348870f5652c4c19c2d4a95cf43c
SHA1 hash:
a5de5f110aadc1693b9705ef9496a81f0c721f9b
Link:
https://www.unpac.me/results/5ccb1014-c02f-45fd-b4be-895b9ac7df84/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe 20fb4600c5fa835a26cd5967d864e2189b15bdc626abadf75be7466cfec9919e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1557920/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/182169/

Comments