MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7
SHA3-384 hash: 147097d9616bcf53e5f443a77baca0575b609acdd1706a3f3310fb16cbe79876488c277eb42aebca49867c8f366419de
SHA1 hash: d56f6916c809e7d8b18d1a5021bd07ec75324568
MD5 hash: 58bcdd6f6048e83acf269515fcc8adf6
humanhash: fruit-sodium-football-ceiling
File name:58bcdd6f6048e83acf269515fcc8adf6.exe
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:498'688 bytes
First seen:2021-08-12 06:36:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 346d1123531c92f702a30851f3faa86c (3 x RaccoonStealer, 3 x KPOTStealer, 2 x RedLineStealer)
ssdeep 12288:8S5eXQlyspXDxpZ4I+sr18jixUiW9u6o1QqtOE5:dkglyS/rWW6iW9u6utO
Threatray 3'717 similar samples on MalwareBazaar
TLSH T1B9B4C030BA90C035E8B211F849B6A37CB9387A71973551CFA2D52AF906346E9EC31797
dhash icon 68e8e8e8aa66a499 (33 x RaccoonStealer, 14 x ArkeiStealer, 11 x RedLineStealer)
Reporter abuse_ch
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
58bcdd6f6048e83acf269515fcc8adf6.exe
Verdict:
Malicious activity
Analysis date:
2021-08-12 06:38:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b927cf4a-fd93-4a65-a3fe-99348ff410d3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178483/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.9767.4589.1323.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f1b3fb31-3add-4ae7-91a3-62eac41e6a29
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/831506
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Detected unpacking (overwrites its own PE header)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 463959 Sample: PlOzdUf8PO.exe Startdate: 12/08/2021 Architecture: WINDOWS Score: 100 49 Multi AV Scanner detection for submitted file 2->49 51 Machine Learning detection for sample 2->51 53 Contains VNC / remote desktop functionality (version string found) 2->53 55 5 other signatures 2->55 8 PlOzdUf8PO.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        process3 file4 35 C:\ProgramData\...\33A2E4F0.exe, PE32 8->35 dropped 59 Detected unpacking (overwrites its own PE header) 8->59 61 Creates autostart registry keys with suspicious names 8->61 16 33A2E4F0.exe 8->16         started        signatures5 process6 dnsIp7 37 ebanat6977769.com 8.209.79.46, 49712, 49727, 49731 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 16->37 39 192.168.2.1 unknown unknown 16->39 41 Multi AV Scanner detection for dropped file 16->41 43 Detected unpacking (overwrites its own PE header) 16->43 45 Machine Learning detection for dropped file 16->45 47 3 other signatures 16->47 20 svchost.exe 16->20         started        23 svchost.exe 16->23 injected 25 dwm.exe 16->25 injected 27 7 other processes 16->27 signatures8 process9 signatures10 57 Changes security center settings (notifications, updates, antivirus, firewall) 20->57 29 BackgroundTransferHost.exe 13 23->29         started        31 backgroundTaskHost.exe 121 58 23->31         started        33 backgroundTaskHost.exe 59 53 23->33         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7/
Verdict:
unknown
Similar samples:
048b796fb78b1a11d598189410f4de21f57094d283fbebaec36fc604b1f66197
KPOTStealer
32e30f494b7bb01ab18836029193c2a79fb63795f978eeed31103f368c6d8fba
KPOTStealer
786b9cb2fa5e78e4bc0d9e67e6f90c0229b150bacfd3e75cf46a9c3a67d57a67
KPOTStealer
82d08c29cb4e61dbe7455ff966f20e33f16e941341790363c00c3d261d4def11
KPOTStealer
87fce4a9bf5b5a94b0a722c3061fd931a2fadd301880801b64a1e78d79bb67c5
KPOTStealer
95654525c7022015e1177ff2e8eba84837f6808b6568bccd87af3e55a3c1f481
KPOTStealer
a7d4ad5e6eedf5be0ad6f9ffc704827b7c1e9aeb12d440c847031af8d4d1f7b1
KPOTStealer
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
KPOTStealer
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
KPOTStealer
+ 3'707 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210812-agx2p3pwbj/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/ae1fdb5d-2fb0-467a-9dd1-c07bdd885f7c/
SH256 hash:
c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7
MD5 hash:
58bcdd6f6048e83acf269515fcc8adf6
SHA1 hash:
d56f6916c809e7d8b18d1a5021bd07ec75324568
Link:
https://www.unpac.me/results/ae1fdb5d-2fb0-467a-9dd1-c07bdd885f7c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe c9052a72f8d94fabf633aa750a1f7dbf0f211ef4be463443d2d064ffa8bb79d7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1525649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178483/

Comments