Overview

overview

10

Static

static

53e1f72ca9...35.exe

windows7_x64

10

53e1f72ca9...35.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135

  • Size

    406KB

  • Sample

    220625-byq4dahaen

  • MD5

    7a53429710e5d456bd79c147316c1bbb

  • SHA1

    4d46fc427c0c5aa412e13b96dd6be72044ceb18d

  • SHA256

    53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135

  • SHA512

    2673325f08ff43f0a6afcdac341f7fe944927153c09efb14e16dd53974cabba283ca41c03a5c40bc5e0d5d5537d7757284ef7dce70383881deb6c0d2efaa769a

Score
10/10
kpotrezer0stealertrojan

Malware Config

Targets

    • Target

      53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135

    • Size

      406KB

    • MD5

      7a53429710e5d456bd79c147316c1bbb

    • SHA1

      4d46fc427c0c5aa412e13b96dd6be72044ceb18d

    • SHA256

      53e1f72ca9dbdfe05ec0baca1f5b5bad453549d7a38845eb14013de9b05f2135

    • SHA512

      2673325f08ff43f0a6afcdac341f7fe944927153c09efb14e16dd53974cabba283ca41c03a5c40bc5e0d5d5537d7757284ef7dce70383881deb6c0d2efaa769a

    Score
    10/10
    kpotrezer0stealertrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • ReZer0 packer

      Detects ReZer0, a packer with multiple versions used in various campaigns.

      rezer0

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks