MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7
SHA3-384 hash: 08f46760430f7ce93d7b43fb74c03bf542d355b8c404bb1441b062dc10def30f7e887c8dd60e230c918ce50b15d6c652
SHA1 hash: 799cad76d1798518e4f56efd7d3b3cf37da84e89
MD5 hash: 4fde5496bc06e055df52b93f304b2bf1
humanhash: ten-carpet-missouri-steak
File name:4fde5496bc06e055df52b93f304b2bf1.exe
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:380'928 bytes
First seen:2021-08-25 12:01:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bd3c9edf948deca79ee5e78523f1a042 (14 x RaccoonStealer, 2 x Smoke Loader, 1 x Stop)
ssdeep 6144:VgHQEKFoXw7uUb0Ht8g0920ipqyXAyldu8rk+9/s0Gw5ORk2cxb:VQ/Xw7uUbg0929qyXAsZrn5fORvcF
Threatray 57 similar samples on MalwareBazaar
TLSH T1BA8401007AB0C577C756947149E6CEB0A63E74A16C264247B7DC9BEF2F61680BE37382
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4fde5496bc06e055df52b93f304b2bf1.exe
Verdict:
Malicious activity
Analysis date:
2021-08-25 12:10:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/265b8ed5-71cc-403b-a731-33e08cbbd397

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182305/
Detection(s):
Win.Packed.Fragtor-9888193-0
Create hunting rule

Win.Packed.Generic-9888330-0
Create hunting rule

Win.Packed.Generic-9888333-0
Create hunting rule

Win.Packed.Generic-9888335-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3030bce-fdb6-4eb0-a050-c11e042cdeff
Result
Threat name:
KPot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/839014
Signature
Contains VNC / remote desktop functionality (version string found)
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected KPot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 471442 Sample: 1DVwU5DCrg.exe Startdate: 25/08/2021 Architecture: WINDOWS Score: 100 36 spinogriz91076299.io 2->36 38 kpotuvorot10.bit 2->38 40 2 other IPs or domains 2->40 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected KPot 2->50 52 Machine Learning detection for sample 2->52 54 Contains VNC / remote desktop functionality (version string found) 2->54 8 1DVwU5DCrg.exe 2 4 2->8         started        12 33A2E4F0.exe 2->12         started        14 33A2E4F0.exe 2->14         started        signatures3 process4 file5 28 C:\ProgramData\...\33A2E4F0.exe, PE32 8->28 dropped 56 Detected unpacking (changes PE section rights) 8->56 58 Creates autostart registry keys with suspicious names 8->58 16 33A2E4F0.exe 8->16         started        signatures6 process7 dnsIp8 30 gorokborotun782699.com 45.33.20.235, 49717, 49718, 49719 LINODE-APLinodeLLCUS United States 16->30 32 45.33.30.197, 49720, 49781, 49789 LINODE-APLinodeLLCUS United States 16->32 34 4 other IPs or domains 16->34 42 Multi AV Scanner detection for dropped file 16->42 44 Machine Learning detection for dropped file 16->44 46 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 16->46 20 WerFault.exe 9 16->20         started        22 WerFault.exe 9 16->22         started        24 WerFault.exe 20 9 16->24         started        26 7 other processes 16->26 signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-08-25 01:06:25 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
22101fe25d7a6acbcec8dc39d177dccb0fb56e6f08f95876963a9f3dfda01b5b
KPOTStealer
250c1dda429b8b2c8b638ddc80999039267bda7b959d5a854c5f4855601df548
KPOTStealer
4934962518447fe675fc3e72322d7e8eb1521bddcd45eae280f98d0b4d138c01
KPOTStealer
5521400dffe660536524b06e28edc0805136092457722f3e1246a8749a0a7471
KPOTStealer
61fe734407cc70105ccbe489e4a70a72f2aaa7591619a6338a34a2f7606bf0b6
KPOTStealer
7b2e4ee7ff0bd5a37d0da1ff5f824ba8d44f264f884dea50a0990f22d2488be9
KPOTStealer
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
KPOTStealer
cceb5da1ebba042d949f4afef5f5e4638826493201564245be0448920dac639c
KPOTStealer
d00956a63d7e56ec5fc098fdc2227523e3022cae1f144c783d64044366d0789c
KPOTStealer
+ 47 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210825-xatrh6eyce/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
8fe1877b2cb312eaa3b1fd4b10bcd9c4050a86f55b602704db3a6a453ff0e7a8
MD5 hash:
2ec55de670faf40bbce8624884512519
SHA1 hash:
de87552e3af4bd3f9cd7baa93b652fc21c60b952
Link:
https://www.unpac.me/results/6c792d01-3e14-413f-ad31-d69200aeb930/
SH256 hash:
ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7
MD5 hash:
4fde5496bc06e055df52b93f304b2bf1
SHA1 hash:
799cad76d1798518e4f56efd7d3b3cf37da84e89
Link:
https://www.unpac.me/results/6c792d01-3e14-413f-ad31-d69200aeb930/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe ccd975821967733598a3d588a2ac2f65fdb2dfbc254713d3726c0709976dc9f7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1557920/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/182305/

Comments