General
- Target jaffacakes118_Trojan-PSW.Win32.Fareit.ezny.94c91488655813149dc60cd7e0341f24
- Size 5.5MB
- Sample261010-py7ysahc64
- SHA256 88bf39c264f678e1af4bb1225439833f88364d41bc51db47c1fa78d0f6c30c71
Score
10/10
Malware Config
Targets
-
- Target jaffacakes118_Trojan-PSW.Win32.Fareit.ezny.94c91488655813149dc60cd7e0341f24
- Size 5.5MB
- SHA256 88bf39c264f678e1af4bb1225439833f88364d41bc51db47c1fa78d0f6c30c71
Score10/10Family: KPOT
KPOT is an information stealer that steals user data and account credentials.
KPOT Core Executable
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Query Registry
4Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1