MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b
SHA3-384 hash: b358058752e9687787cd452003af2c44439b303cd3d105174560fd440ec2adc98753e983d018476cfde31f68fe1f997f
SHA1 hash: bb2d1b4e68a3e1b9869f0a5755e25ef16ac664b9
MD5 hash: d4bcbd31d9138b2d6f86d109c4dad6f4
humanhash: floor-gee-indigo-beer
File name:d4bcbd31d9138b2d6f86d109c4dad6f4.exe
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:353'280 bytes
First seen:2021-08-24 06:42:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f519e58768c36b2651aa4c0b9c28c9d (12 x RaccoonStealer, 2 x Smoke Loader, 2 x Stop)
ssdeep 6144:OsF31t5bxy5WCICtRec+a4r+Faw6zW6CIe1w:OsF3FxYlIBaK+Faeh
Threatray 4'942 similar samples on MalwareBazaar
TLSH T1DF74F1107BA4CD37F541723588E59AF1F22EF955AA7688373BC816AA1EB01D0F336316
dhash icon 1072c093b0381902 (22 x RedLineStealer, 7 x RaccoonStealer, 4 x Smoke Loader)
Reporter abuse_ch
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
136
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d4bcbd31d9138b2d6f86d109c4dad6f4.exe
Verdict:
Malicious activity
Analysis date:
2021-08-24 06:47:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1a30db9e-4029-4e39-ac85-e2af5a2143bb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181762/
Detection(s):
SecuriteInfo.com.BackDoor.Siggen2.3559.2610.26631.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8fb0c5a5-98d8-4070-9f6c-cd407acddaf9
Result
Threat name:
KPot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/838011
Signature
Contains VNC / remote desktop functionality (version string found)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected KPot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 470443 Sample: gQfjrT4UZB.exe Startdate: 24/08/2021 Architecture: WINDOWS Score: 100 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected KPot 2->45 47 Machine Learning detection for sample 2->47 49 Contains VNC / remote desktop functionality (version string found) 2->49 7 gQfjrT4UZB.exe 2 4 2->7         started        11 33A2E4F0.exe 2->11         started        13 33A2E4F0.exe 2->13         started        process3 file4 41 C:\ProgramData\...\33A2E4F0.exe, PE32 7->41 dropped 51 Detected unpacking (changes PE section rights) 7->51 53 Creates autostart registry keys with suspicious names 7->53 15 33A2E4F0.exe 7->15         started        signatures5 process6 signatures7 55 Multi AV Scanner detection for dropped file 15->55 57 Detected unpacking (changes PE section rights) 15->57 59 Machine Learning detection for dropped file 15->59 61 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 15->61 18 WerFault.exe 9 15->18         started        21 WerFault.exe 9 15->21         started        23 WerFault.exe 9 15->23         started        25 6 other processes 15->25 process8 file9 27 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 18->27 dropped 29 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 21->29 dropped 31 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 23->31 dropped 33 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 25->33 dropped 35 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 25->35 dropped 37 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 25->37 dropped 39 2 other malicious files 25->39 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-24 06:42:16 UTC
AV detection:
21 of 42 (50.00%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0f8024be3da4951480fa2fc6459426d7a4b0d9f46ec8fcbb04a3b8ccfca674d0
KPOTStealer
250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548
KPOTStealer
2e3b767101904dd4352ece4ac162a9253edc02609db93ef70801e3a6fe1268f4
KPOTStealer
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
KPOTStealer
74e82ea63f25fdb065ab8d4df1d69f9a22d1c1a76edf609f2f22d5080411fe4c
KPOTStealer
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
KPOTStealer
9f1c935d143a59d2429f2681007c61ee07504302e5798d7abdb9a5d44d90e13b
KPOTStealer
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
KPOTStealer
c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7
KPOTStealer
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
KPOTStealer
+ 4'932 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210824-b5cbhtwt3x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/10723a46-8910-48f3-9534-88e2bf67f52a/
SH256 hash:
22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b
MD5 hash:
d4bcbd31d9138b2d6f86d109c4dad6f4
SHA1 hash:
bb2d1b4e68a3e1b9869f0a5755e25ef16ac664b9
Link:
https://www.unpac.me/results/10723a46-8910-48f3-9534-88e2bf67f52a/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/22101fe25d7a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe 22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1557920/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181762/

Comments