MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d720af33d2bfd971d3b8e281c5f1b463389f9923eff1efa81351fd0e1a413e94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
KPOTStealer
Vendor detections: 4
| SHA256 hash: | d720af33d2bfd971d3b8e281c5f1b463389f9923eff1efa81351fd0e1a413e94 |
|---|---|
| SHA3-384 hash: | 829c0c3557c5b5467d38fc48c97696cfbd1098a134ed16c057770c40f96b53daa0176da9c6dbb3eeff60f84beb1381d4 |
| SHA1 hash: | 1527840208b7b5be20bb2f4950715888ddfcaf0e |
| MD5 hash: | 69faed1cc72cef8fae38ebf4b275b42c |
| humanhash: | pennsylvania-venus-fillet-equal |
| File name: | COVID-19 Relief Payment Approval RefC19V202991.pdf.exe |
| Download: | download sample |
| Signature | KPOTStealer |
| File size: | 357'888 bytes |
| First seen: | 2020-05-13 15:48:15 UTC |
| Last seen: | 2020-05-13 17:07:05 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6b47567c69827e13eace24f99991ee43 (1 x KPOTStealer) |
| ssdeep | 6144:PZxt7KNA7ywSG9p82qiLMoB7YRGuVP7NSVhL1Ws:hx5JT9pqiTBfuRRSf |
| Threatray | 104 similar samples on MalwareBazaar |
| TLSH | 0874BE20F6D1C072C5B6057084D2C6BF5ABEB8E557215AC32B9417AFFE303D28A35A4E |
| Reporter |  abuse_ch |
| Tags: | COVID-19 exe geo KPOTStealer ZAF |
abuse_ch
Malspam distributing KPOTStealer:HELO: host.sarmcol.com
Sending IP: 199.217.117.157
From: covid19fund@smmesa.gov.za
Subject: COVID-19 Relief Payment Approval (Ref: C19V202991)
Attachment: COVID-19 Relief Payment Approval Ref C19V202991.pdf.gz (contains "COVID-19 Relief Payment Approval Ref C19V202991.pdf.exe")
KPOTStealer C2:
http://golaantsystem.xyz/EAVwqwP1NXrvn9uF/util.php
Intelligence
File Origin
# of uploads :
2
# of downloads :
114
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-05-13 16:36:25 UTC
File Type:
PE (Exe)
Extracted files:
46
AV detection:
26 of 31 (83.87%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 94 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Runs ping.exe
Suspicious use of WriteProcessMemory
Deletes itself
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.