Loading malware…
Kegotip is a Windows banking trojan and information-stealing malware family associated with financially motivated cybercrime operations in the mid-2010s. It was distributed by large spam-driven delivery ecosystems including campaigns linked to the Necurs botnet, and was observed being propagated by loaders such as Upatre and RockLoader. TA505 also briefly distributed Kegotip in 2017 through malicious email campaigns using macro-enabled documents and archived scripts.
Kegotip is known for credential theft and harvesting email addresses from infected systems, indicating both financial fraud and follow-on spam enablement objectives. Its observed use alongside other banking malware and ransomware families places it within the broader criminal malware-as-a-service and affiliate distribution landscape that included payload rotation based on campaign needs.
Delivery activity tied to Kegotip has included phishing emails carrying malicious attachments, with documented use of Office documents containing macros as well as script-based attachments delivered in archives. The malware targeted Windows environments and appeared in campaigns aimed at enterprise and general business victims, particularly in regions heavily targeted by large-volume financial malware spam operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA505 briefly distributed the Kegotip information stealer in April 2017.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
In recent weeks, we detected a marked increase in email campaigns attempting to install Locky... This particular campaign... used malicious document attachments... Outside of the very large campaign detected on April 7th, the ransomware in many of these campaigns is being installed via JavaScript attachment files rather than documents.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family historically delivered by Upatre.
Credential and email-address harvesting infostealer (FTP clients, Outlook, Internet Explorer) used to support further crimeware/spam operations; delivered via macro docs and zipped VBScript attachments.
Malware payload observed being delivered by RockLoader in addition to Locky, Dridex 220, and Pony.
Banking trojan mentioned in the Necurs appendix as one of several payloads distributed by the botnet.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.