MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9
SHA3-384 hash: 7f242c9c3cf2b90c12bd03e982c7633eeada68a09ce7de9f631463bb3902f436ba57e815ab6a4ddfb94ff326eb792121
SHA1 hash: 8c369cc973d7e25dc01791cae7c4d95a824114f4
MD5 hash: 24fbf2c94a2d4e2d4849f224a99d73cf
humanhash: low-bacon-mississippi-vermont
File name:SecuriteInfo.com.Variant.Fragtor.10550.1872.9084
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:451'584 bytes
First seen:2021-08-23 22:12:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4dcb3c3a3fe5e134dd41266130cc79d2 (6 x RaccoonStealer, 4 x RedLineStealer, 3 x Tofsee)
ssdeep 12288:g7G8m+ge1EQLI9iDeJPuN1Qcia6R2MYoEx4pSvK:Yge1xePuFiLhYo1S
Threatray 47 similar samples on MalwareBazaar
TLSH T106A4CF30AAA1C034E0F612F895BA87B8B43A7AB15B7450CF53D516EE5B387E4AC30757
dhash icon ead8a89cc6e68ea0 (25 x RaccoonStealer, 8 x DanaBot, 8 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Variant.Fragtor.10550.1872.9084
Verdict:
Malicious activity
Analysis date:
2021-08-23 22:14:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0f4a1d1f-9ab5-49ba-bea9-11ae6e11ce2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181647/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.10550.1872.9084.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b325f68e-342e-48ee-b88e-3ebe6ad5359a
Result
Threat name:
KPot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/837851
Signature
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Yara detected KPot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 470282 Sample: SecuriteInfo.com.Variant.Fr... Startdate: 24/08/2021 Architecture: WINDOWS Score: 100 57 Multi AV Scanner detection for submitted file 2->57 59 Yara detected KPot 2->59 61 Machine Learning detection for sample 2->61 63 6 other signatures 2->63 8 SecuriteInfo.com.Variant.Fragtor.10550.1872.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        process3 file4 43 C:\ProgramData\...\33A2E4F0.exe, PE32 8->43 dropped 65 Detected unpacking (changes PE section rights) 8->65 67 Creates autostart registry keys with suspicious names 8->67 16 33A2E4F0.exe 8->16         started        signatures5 process6 dnsIp7 45 ebanat6977769.com 206.54.191.4, 49700, 49718, 80 WZCOM-US United States 16->45 49 Multi AV Scanner detection for dropped file 16->49 51 Detected unpacking (changes PE section rights) 16->51 53 Machine Learning detection for dropped file 16->53 55 3 other signatures 16->55 20 svchost.exe 16->20 injected 22 svchost.exe 16->22 injected 24 dwm.exe 16->24 injected 26 9 other processes 16->26 signatures8 process9 process10 28 backgroundTaskHost.exe 139 58 20->28         started        31 BackgroundTransferHost.exe 13 20->31         started        33 backgroundTaskHost.exe 2 14 20->33         started        41 4 other processes 20->41 35 UsoClient.exe 22->35         started        37 taskhostw.exe 22->37         started        39 UpdateNotificationMgr.exe 22->39         started        dnsIp11 47 192.168.2.1 unknown unknown 28->47
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-23 20:33:33 UTC
AV detection:
20 of 46 (43.48%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pmxe5z77bpk2g7inuh7v7aslvdke6jsprbg6uufatehsfusirpuq._file
Verdict:
unknown
Similar samples:
0f8024be3da4951480fa2fc6459426d7a4b0d9f46ec8fcbb04a3b8ccfca674d0
KPOTStealer
2e3b767101904dd4352ece4ac162a9253edc02609db93ef70801e3a6fe1268f4
KPOTStealer
35f0fd2e322b088525d860105208e5cdd39f85b0016b56d9e76cff8bbc542179
KPOTStealer
50f02c9841c7e3215d91c1ec926ebc3863d76a664899e742b0a4a7a74cc4368e
KPOTStealer
596e82d24c64a373095159ee769df582d6f34fde24eb537aca442d8f01c491db
KPOTStealer
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
KPOTStealer
82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11
KPOTStealer
94198327544af310a9c7911096baa5cbf6fe5d02e2b0ba452082ecbc3a67543a
KPOTStealer
9f1c935d143a59d2429f2681007c61ee07504302e5798d7abdb9a5d44d90e13b
KPOTStealer
f5657913e8e52fec07fe5604c87997c7f96d708ab90262f6cc65864f85f55160
KPOTStealer
+ 37 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210823-9ptk1xkswj/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/c4aa7d26-2f1c-4fe6-85d5-4664c05585ce/
SH256 hash:
7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9
MD5 hash:
24fbf2c94a2d4e2d4849f224a99d73cf
SHA1 hash:
8c369cc973d7e25dc01791cae7c4d95a824114f4
Link:
https://www.unpac.me/results/c4aa7d26-2f1c-4fe6-85d5-4664c05585ce/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe 7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1557920/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181647/

Comments