KPOT Stealer (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.kpot_stealer (Back to overview)

KPOT Stealer

aka: Khalesi, Kpot

URLhaus

There is no description at this point.

References

2021-07-07 ⋅ Medium s2wlab ⋅ Seunghoe Kim
Deep analysis of KPOT Stealer
KPOT Stealer

2021-04-12 ⋅ PTSecurity ⋅ PTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader

2020-12-15 ⋅ Github (Dump-GUY) ⋅ Jiří Vinopal
Reverse engineering KPOT v2.0 Stealer
KPOT Stealer

2020-11-04 ⋅ ZDNet ⋅ Catalin Cimpanu
REvil ransomware gang 'acquires' KPOT malware
KPOT Stealer REvil

2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader

2020-04-26 ⋅ Nullteilerfrei Blog ⋅ Lars Wallenborn
use Ghidra to Decrypt Strings of KPOTstealer Malware
KPOT Stealer

2020-04-12 ⋅ InfoSec Handlers Diary Blog ⋅ Vinnie
Dynamic analysis technique to get decrypted KPOT Malware
KPOT Stealer

2020-04-01 ⋅ Cisco ⋅ Shyam Sundar Ramaswami, Andrea Kaiser
Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors
Azorult CloudEyE Formbook KPOT Stealer Metamorfo Nanocore RAT NetWire RC TrickBot

2020-03-23 ⋅ SANS ISC ⋅ Didier Stevens
KPOT Deployed via AutoIt Script
KPOT Stealer

2019-05-09 ⋅ Proofpoint ⋅ Dennis Schwarz, Proofpoint Threat Insight Team
New KPOT v2.0 stealer brings zero persistence and in-memory features to silently steal credentials
KPOT Stealer

2019-04-11 ⋅ Dr.Web ⋅ Dr. Web
The official website of a popular video editing software was infected with a banking trojan
KPOT Stealer

2018-10-25 ⋅ enSilo ⋅ Chen Erlich, Yakov Goldberg
Game of Trojans: Dissecting the #Khalesi Infostealer Malware
KPOT Stealer

2018-09-12 ⋅ Flashpoint ⋅ Paul Burbage, Mike Mimoso
Malware Campaign Targeting Jaxx Cryptocurrency Wallet Users Shut Down
KPOT Stealer

Yara Rules

[TLP:WHITE] win_kpot_stealer_auto (20230125 | Detects win.kpot_stealer.)

rule win_kpot_stealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.kpot_stealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83f92f 7414 83f95c 740a 83f962 7560 c60008 }
            // n = 7, score = 500
            //   83f92f               | cmp                 ecx, 0x2f
            //   7414                 | je                  0x16
            //   83f95c               | cmp                 ecx, 0x5c
            //   740a                 | je                  0xc
            //   83f962               | cmp                 ecx, 0x62
            //   7560                 | jne                 0x62
            //   c60008               | mov                 byte ptr [eax], 8

        $sequence_1 = { 59 59 0fbec8 8d841df0feffff 8a10 8d8c0df0feffff 8a19 }
            // n = 7, score = 500
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   0fbec8               | movsx               ecx, al
            //   8d841df0feffff       | lea                 eax, [ebp + ebx - 0x110]
            //   8a10                 | mov                 dl, byte ptr [eax]
            //   8d8c0df0feffff       | lea                 ecx, [ebp + ecx - 0x110]
            //   8a19                 | mov                 bl, byte ptr [ecx]

        $sequence_2 = { eb03 0175fc 33f6 3975fc }
            // n = 4, score = 500
            //   eb03                 | jmp                 5
            //   0175fc               | add                 dword ptr [ebp - 4], esi
            //   33f6                 | xor                 esi, esi
            //   3975fc               | cmp                 dword ptr [ebp - 4], esi

        $sequence_3 = { 0bc1 0fb64f03 ff750c c1e118 0bc1 0fb64f04 c1e208 }
            // n = 7, score = 500
            //   0bc1                 | or                  eax, ecx
            //   0fb64f03             | movzx               ecx, byte ptr [edi + 3]
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   c1e118               | shl                 ecx, 0x18
            //   0bc1                 | or                  eax, ecx
            //   0fb64f04             | movzx               ecx, byte ptr [edi + 4]
            //   c1e208               | shl                 edx, 8

        $sequence_4 = { 8b4508 8bd7 b301 e8???????? 893e ff75fc }
            // n = 6, score = 500
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8bd7                 | mov                 edx, edi
            //   b301                 | mov                 bl, 1
            //   e8????????           |                     
            //   893e                 | mov                 dword ptr [esi], edi
            //   ff75fc               | push                dword ptr [ebp - 4]

        $sequence_5 = { 8ac3 e8???????? 84c0 7505 8b55f0 eb6b }
            // n = 6, score = 500
            //   8ac3                 | mov                 al, bl
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7505                 | jne                 7
            //   8b55f0               | mov                 edx, dword ptr [ebp - 0x10]
            //   eb6b                 | jmp                 0x6d

        $sequence_6 = { 895df0 85f6 7904 8bf7 eb01 4f }
            // n = 6, score = 500
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   85f6                 | test                esi, esi
            //   7904                 | jns                 6
            //   8bf7                 | mov                 esi, edi
            //   eb01                 | jmp                 3
            //   4f                   | dec                 edi

        $sequence_7 = { 33c1 23c6 8bf0 33d7 }
            // n = 4, score = 500
            //   33c1                 | xor                 eax, ecx
            //   23c6                 | and                 eax, esi
            //   8bf0                 | mov                 esi, eax
            //   33d7                 | xor                 edx, edi

        $sequence_8 = { ff00 8b08 803922 741e 8a11 84d2 }
            // n = 6, score = 500
            //   ff00                 | inc                 dword ptr [eax]
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   803922               | cmp                 byte ptr [ecx], 0x22
            //   741e                 | je                  0x20
            //   8a11                 | mov                 dl, byte ptr [ecx]
            //   84d2                 | test                dl, dl

        $sequence_9 = { 8bc1 c1e810 884306 8b45f4 }
            // n = 4, score = 500
            //   8bc1                 | mov                 eax, ecx
            //   c1e810               | shr                 eax, 0x10
            //   884306               | mov                 byte ptr [ebx + 6], al
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

    condition:
        7 of them and filesize < 219136
}

[TLP:WHITE] win_kpot_stealer_w0 (20190106 | Kpot)

rule win_kpot_stealer_w0 {
    meta:
        description = "Kpot"
        type = "Stealer"
        author = "Fumik0_"
        date = "30/08/2018"

        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer"
        malpedia_version = "20190106"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $mz = { 4d 5a }

        // Variant 1
        $v1_s1 = "GET %s HTTP/1.1" wide ascii
        $v1_s2 = "Host: %s" wide ascii
        $v1_s3 = "%02d-%02d-%02d %d:%02d:%02d" wide ascii
        $v1_s4 = "%S/base64.php?_f=%S" wide ascii      
        $v1_s5 = "IP: %S" wide ascii
        $v1_s6 = "MachineGuid: %s" wide ascii
        $v1_s7 = "CPU: %S (%d cores)" wide ascii
        $v1_s8 = "RAM: %S MB" wide ascii
        $v1_s9 = "Screen: %dx%d" wide ascii
        $v1_s10 = "PC: %s" wide ascii
        $v1_s11 = "User: %s" wide ascii
        $v1_s12 = "LT: %S (UTC+%d:%d)" wide ascii
        $v1_s13 = "GPU:" wide ascii
        $v1_s14 = "regbot.php" wide ascii
        $v1_s15 = "ip.php" wide ascii

        // Variant 2
        $v2_s1 = "GET %s HTTP/1.1" wide ascii
        $v2_s2 = "%s/%s.php" wide ascii
        $v2_s3 = "%s/gate.php" wide ascii
        $v2_s4 = "RAM: %s MB" wide ascii
        $v2_s5 = "IP: %s" wide ascii
        $v2_s6 = "CPU: %s (%d cores)" wide ascii
        $v2_s7 = "RAM: %s MB" wide ascii
        $v2_s8 = "Screen: %dx%d" wide ascii
        $v2_s9 = "LT: %s (UTC+%d:%d)" wide ascii
        $v2_s10 = "GPU:" wide ascii
        $v2_s11 = "screen.png" wide ascii

    condition:
        ($mz at 0) and ( (all of ($v1_*)) or (all of ($v2_*)) )
}

Download all Yara Rules

KPOT Stealer Propose Change

References

Yara Rules

KPOT Stealer