Overview

overview

10

Static

static

10

kdot.ps1

windows7-x64

3

kdot.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    kdot.ps1

  • Size

    74KB

  • Sample

    240705-tpde2atfjb

  • MD5

    0cb37de329eed6ef83d5da40ffcd03cc

  • SHA1

    9713568bc1a290eca44e98dc883d3e431a3e6889

  • SHA256

    06aa6e3b7c70a33192655104272687e631ef0fa1d7ba78a582ebe8c47cc3cad4

  • SHA512

    6e6376729fe7b58cc281214368333f00a230d4279a50ee8bbc83f1c3041f1e2211e963b584493e029a60f972841d79d0ee29b9b91a6d281a2341b08f9c47b92b

  • SSDEEP

    1536:1SDVn5ahg5yYp6zdv/5l05Qo8l01zhwZPhZcLcJS7srHX6Cx:1SDVn5Uwiv/5IQo8l01zhw5hUc9KCx

Score
10/10
executionpersistenceprivilege_escalation

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://users-arg.gl.at.ply.gg:59170/data

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://github.com/Somali-Devs/Kematian-Stealer/raw/main/frontend-src/webcam.ps1

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://github.com/Somali-Devs/Kematian-Stealer/raw/main/frontend-src/kematian_shellcode.ps1

Targets

    • Target

      kdot.ps1

    • Size

      74KB

    • MD5

      0cb37de329eed6ef83d5da40ffcd03cc

    • SHA1

      9713568bc1a290eca44e98dc883d3e431a3e6889

    • SHA256

      06aa6e3b7c70a33192655104272687e631ef0fa1d7ba78a582ebe8c47cc3cad4

    • SHA512

      6e6376729fe7b58cc281214368333f00a230d4279a50ee8bbc83f1c3041f1e2211e963b584493e029a60f972841d79d0ee29b9b91a6d281a2341b08f9c47b92b

    • SSDEEP

      1536:1SDVn5ahg5yYp6zdv/5l05Qo8l01zhwZPhZcLcJS7srHX6Cx:1SDVn5Uwiv/5IQo8l01zhw5hUc9KCx

    Score
    10/10
    executionpersistenceprivilege_escalation

    • Blocklisted process makes network request

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks