Overview

overview

10

Static

static

7

8cec5674b6...8f.exe

windows7_x64

10

8cec5674b6...8f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f

  • Size

    2.0MB

  • Sample

    220625-drh6asbhhm

  • MD5

    12b7b9665e3a32bda9155e0f486359cd

  • SHA1

    5acf1375160eacfd2a77db61f1a31705a8ba035c

  • SHA256

    8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f

  • SHA512

    6ec801927336c96e0df56ab39e5834bb0c657a9798502c2b66e667587846c80b717925f716e760dc54ded0e4ee70da1cdf87c4daf145a40102c08dd1ec4d2e65

Score
10/10
kpotevasionstealerthemidatrojan

Malware Config

Targets

    • Target

      8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f

    • Size

      2.0MB

    • MD5

      12b7b9665e3a32bda9155e0f486359cd

    • SHA1

      5acf1375160eacfd2a77db61f1a31705a8ba035c

    • SHA256

      8cec5674b6fde7977e8c65e5f8026b5c413851f1c0c00637c56ac111578e9a8f

    • SHA512

      6ec801927336c96e0df56ab39e5834bb0c657a9798502c2b66e667587846c80b717925f716e760dc54ded0e4ee70da1cdf87c4daf145a40102c08dd1ec4d2e65

    Score
    10/10
    kpotevasionstealerthemidatrojan

    • KPOT

      KPOT is an information stealer that steals user data and account credentials.

      trojanstealerkpot

    • KPOT Core Executable

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks