kpot | a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7

General

Target
a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7
Size 858KB
Sample240429-a12r8ade21
SHA256 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7
MD5 be0e619026ab61ce6f26cfac1662abe5
SHA1 c62908e7042a7c1ccd63d3c14924e6231e983e69
SHA512 453b6478100234d470e1c9cd340424482d31e7aba931494a044278160efb48017983d3982b64100f7c6ae462f5f01136f3b80cc39dea32b66aff0f1d0e746fb3
SSDEEP 12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSs9U3NL9WEEoLPw9IWPzX:zQ5aILMCfmAUjzX6xQt9U3917LwpP7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot

Malware Config

Signatures

KPOT Core Executable 1 IoCs

resource	yara_rule
sample	family_kpot

Kpot family
kpot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7

File Explorer

a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7

.exe 858KB

a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7

IMPHASH 58471b8a9f8702d1a9e4838d7b7d501a
SHA256 a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7
MD5 be0e619026ab61ce6f26cfac1662abe5
SHA1 c62908e7042a7c1ccd63d3c14924e6231e983e69
SHA512 453b6478100234d470e1c9cd340424482d31e7aba931494a044278160efb48017983d3982b64100f7c6ae462f5f01136f3b80cc39dea32b66aff0f1d0e746fb3
SSDEEP 12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSs9U3NL9WEEoLPw9IWPzX:zQ5aILMCfmAUjzX6xQt9U3917LwpP7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

KPOT Core Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysFreeString SysAllocStringLen SysAllocStringByteLen SysStringLen

user32

LoadStringW WaitMessage

kernel32

GetProcAddress VirtualAlloc VirtualProtect GetStartupInfoW RtlMoveMemory WideCharToMultiByte SetFileApisToOEM GetModuleHandleW SetFileApisToANSI GetUserDefaultLCID

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaVarIdiv __vbaFreeVarList _adj_fdiv_m64 __vbaVarFix _adj_fprem1 __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaVarForInit __vbaVarPow __vbaObjSet _adj_fdiv_m16i _adj_fdivr_m16i ord706 __vbaBoolVarNull _CIsin __vbaChkstk EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaVarOr __vbaRedimPreserve _adj_fpatan __vbaRedim EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaUI1I4 __vbaVarMul __vbaExceptHandler _adj_fprem _adj_fdivr_m64 __vbaVarDiv __vbaFPException __vbaUbound __vbaStrVarVal _CIlog __vbaErrorOverflow __vbaVar2Vec __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaFreeStrList _adj_fdivr_m32 __vbaR8Var _adj_fdiv_r ord100 __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd _CIatan __vbaStrMove _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing