MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KPOTStealer


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298
SHA3-384 hash: 285d425466301010ec194eb6c1dd99663541673889a7da44b09967a11b79140d1a199518288ca42ea66e172cf489ed87
SHA1 hash: 18e35b63230195f144be197944f34efdb9e0e5bc
MD5 hash: c327b04826b680b29ff3dcd36aa14bf2
humanhash: solar-west-bacon-april
File name:c327b04826b680b29ff3dcd36aa14bf2.exe
Download: download sample
Signature KPOTStealer
Create hunting rule
File size:457'728 bytes
First seen:2022-01-08 15:58:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3f07075ef838296be9ff2ad3cf3a6bc2 (2 x RedLineStealer, 1 x KPOTStealer, 1 x ArkeiStealer)
ssdeep 6144:o5LOY3Ltn0nh5JjefT2Ok/+JUjFv7n0eLS+baZolDst7WDWyfEof:o5q4QJSfHBJYFLjOmLfP
Threatray 82 similar samples on MalwareBazaar
TLSH T14AA4F12AFAB3C431D19F4A714C24C6E01E3F79612A20455F779817FE5FB72A0692A336
File icon (PE):PE icon
dhash icon fcfcd4f4d4d4d8c0 (23 x RedLineStealer, 21 x RaccoonStealer, 6 x Smoke Loader)
Reporter abuse_ch
Tags:exe KPOTStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
367
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c327b04826b680b29ff3dcd36aa14bf2.exe
Verdict:
Malicious activity
Analysis date:
2022-01-08 16:01:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/35b0c53e-14a7-4b49-a595-1166525e93b7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/217830/
Detection(s):
Win.Dropper.Tofsee-9919472-0
Create hunting rule

Win.Dropper.Lockbit-9919572-0
Create hunting rule

Win.Malware.Stopcrypt-9933337-0
Create hunting rule

Win.Dropper.Tofsee-9934046-0
Create hunting rule

Win.Dropper.Tofsee-9934861-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching the default Windows debugger (dwwin.exe)
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/3868/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/61d9b4cd02e388f9fdb6c67c/reports/36c314cb-c80a-41a5-bec6-568ec2e88581/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/89482de1-b3d3-43b3-aed0-ec61559c0c61
Result
Threat name:
KPot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/917154
Signature
Antivirus detection for URL or domain
Creates autostart registry keys with suspicious names
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected KPot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-01-08 15:59:14 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2bnjar5gxlqxfa65wl2vu5i2posogqpmsld4m2e2dx4pkz2wkma._file
Verdict:
malicious
Similar samples:
21ac934d3aa98d29e784fa39d9264c307ade550a7dd43294bf386d46fd6a8218
KPOTStealer
2a640c29784cbbd0596f891d0441ca6eee93df6fac2099458d119cceeaa319cd
KPOTStealer
302c3947f06cbc4cac187f9ec7ae4e24e19633667d009ff1ac44e807cf5f4ace
KPOTStealer
5f475220b444b81a9a18bc08f4c67a63d6c4bc3a2ebd9ff3b1cb90434e539335
KPOTStealer
6333f389181c76117d37276d178e4dd341e3837794e5c40847a8b7d56c743004
KPOTStealer
78bfb7e237882d6ccb83e4e70ffd9f1f06cd834eddeb792108352c257b719b4a
KPOTStealer
8a27d6d4ebe9d3952090f40e744665afc1fbd5c92cb85fbc2a87c3577864daad
KPOTStealer
8d8c3b2faad41e9ab9f51921a9f255c5c5010ab8adc2fdb77a0aa04572dda0c2
KPOTStealer
a66f72560530a5cd994dce7da452f98287617f48db7d662ee5be6b0773cbbb75
KPOTStealer
be5f53f3c41671c23e00ce8665c75ffd1ce170fd0e098309417d009013b51f2d
KPOTStealer
+ 72 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/220108-te3beadeen/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
7cc14bc5997f175a645d73decb9a0498652bd50266a37f8f5a6a7e4bdd0db562
MD5 hash:
97bf9646025824e5ae45b515b2d95d19
SHA1 hash:
a3120785fb942db5859605d3f018de33bd1000ce
Detections:
win_misha_w0
Create hunting rule
Link:
https://www.unpac.me/results/f0c40020-469a-4138-9260-47f8e3bcca21/
Parent samples :
ea59232e0153ff131963fbdabd175ff588392125eb31ebd877d35ef07aea9958
2a640c29784cbbd0596f891d0441ca6eee93df6fac2099458d119cceeaa319cd
5f475220b444b81a9a18bc08f4c67a63d6c4bc3a2ebd9ff3b1cb90434e539335
78bfb7e237882d6ccb83e4e70ffd9f1f06cd834eddeb792108352c257b719b4a
6333f389181c76117d37276d178e4dd341e3837794e5c40847a8b7d56c743004
be5f53f3c41671c23e00ce8665c75ffd1ce170fd0e098309417d009013b51f2d
302c3947f06cbc4cac187f9ec7ae4e24e19633667d009ff1ac44e807cf5f4ace
8d8c3b2faad41e9ab9f51921a9f255c5c5010ab8adc2fdb77a0aa04572dda0c2
21ac934d3aa98d29e784fa39d9264c307ade550a7dd43294bf386d46fd6a8218
8a27d6d4ebe9d3952090f40e744665afc1fbd5c92cb85fbc2a87c3577864daad
ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298
fc8502c4a245ffff9871e4fb368169fcc36ce195935438469e6068f4f90e1e9e
SH256 hash:
ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298
MD5 hash:
c327b04826b680b29ff3dcd36aa14bf2
SHA1 hash:
18e35b63230195f144be197944f34efdb9e0e5bc
Link:
https://www.unpac.me/results/f0c40020-469a-4138-9260-47f8e3bcca21/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ce82d4823d35/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KPOTStealer

Executable exe ce82d4823d35d70b941eed97aad3a8d3dd271a0f64963e3344d0efc7ab3ab298

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1945115/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/217830/

Comments