Loading malware…
KPOT Stealer is a Windows information-stealing malware family sold in cybercrime markets and used in criminal delivery campaigns since at least 2018. It is designed to collect and exfiltrate credentials, cookies, autofill data, account information, and other sensitive artifacts from a broad set of applications, including web browsers, instant messengers, email clients, VPN software, remote access tools, FTP clients, cryptocurrency wallets, and gaming platforms. Documented targets include Chrome, Firefox, Internet Explorer, Outlook, Skype, Telegram, Discord, Steam, Battle.net, WinSCP, FileZilla, RDP-related data, Windows credentials, and multiple cryptocurrency applications and wallets.
Technically, KPOT is written in C/C++ and commonly employs packed samples, encrypted strings, and runtime API resolution to hinder analysis. Important strings are stored in encrypted form and decrypted with XOR-based routines at runtime. The malware resolves Windows APIs dynamically by parsing the PEB and hashing export names with a Murmur3-based algorithm, avoiding straightforward static imports. It communicates with command-and-control infrastructure over HTTP, retrieves tasking and configuration data, and exfiltrates collected results in encrypted form. Observed tasking includes theft of browser and application data, screenshot capture, collection of host profiling information, and file theft based on server-supplied grabber rules. Some analyzed variants also perform a geographic check and terminate on systems located in CIS countries.
Observed delivery has included email campaigns, exploit-kit activity, and malicious software download chains. One documented infection chain used a malicious RTF attachment exploiting CVE-2017-11882 to stage a downloader and ultimately deploy KPOT. The malware has also been distributed through compromised websites that replaced legitimate software downloads with trojanized installers. TA578 has been observed delivering KPOT in email-based campaigns alongside other crimeware families. In analyzed cases, some samples lacked a persistence mechanism and instead executed assigned tasks, posted results, and exited.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
the attachment was an LCG Kit variant RTF document which uses Equation Editor exploit CVE-2017-11882 to download an intermediate downloader via a bit.ly link | KPOT Stealer is a “stealer” malware that focuses on exfiltrating account information and other data from web browsers, instant messengers, email, VPN, RDP, FTP, cryptocurrency, and gaming software.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA578 since May 2020 and uses email campaigns to deliver malware like Ursnif, IcedID, KPOT Stealer, Buer Loader, and BazaLoader
25 distinct techniques documented for this family, organized by ATT&CK tactic.
This time hackers took a different approach to spreading the malware: they embedded a malicious JavaScript code inside the VSDC website. Its task was to determine the visitor’s geolocation and replace download links for users from the UK, USA, Canada and Australia.
Doctor Web researchers discovered that the official website of a well-known video editing software, VSDC, was compromised. The hackers hijacked download links on the website causing visitors to download a dangerous banking trojan, Win32.Bolik.2, and the Trojan.PWS.Stealer (KPOT stealer) along with the editing software.
You can see that the sample has only 4 imports and the entropy of the .text code section is too high – packed. So for now we know that we have to deal with sample which is some kind of stealer and it is probably encrypted or packed.
You can see that the sample has only 4 imports and the entropy of the .text code section is too high – packed.
This last part as you can see is responsible for resolving all API functions and saving them to .data section in memory.
sub_4101AB – ping + delete main module (kpot2.exe) always called before exit().
This function is the most interesting where string decryption and API resolving happens... It looks like some basic xor cipher.
Steal cookies, passwords, and autofill data from Chrome... Steal cookies, passwords, and autofill data from Firefox... Steal cookies from Internet Explorer
Sections include: 62-byte structure containing: Is process token elevated Process integrity level
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information-stealing malware family mentioned as part of TA578 delivery campaigns.
An information-stealing malware family mentioned as part of TA578's historical delivery set.
An information-stealing malware family mentioned as part of TA578's historical campaigns.
A C/C++ information-stealing malware sold commercially on underground forums. It steals credentials, cookies, autofill data, cryptocurrency wallet files, messaging and gaming accounts, VPN/RDP/FTP data, can take screenshots, exfiltrate arbitrary files via configurable grabber rules, and communicates with its C2 over HTTP.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.