MalwareUsed by 1 actor

KPOT

KPOT is a Windows information-stealing malware family active since at least 2018 and commonly referred to as an infostealer trojan. It is designed to harvest credentials and other sensitive data from infected systems, including browser-stored passwords and cookies, email and messaging client data, VPN and RDP credentials, FTP credentials, Windows-stored secrets, cryptocurrency wallet-related data, gaming account data, and session material from selected applications. Reported behavior also includes host profiling and exfiltration of collected data to attacker-controlled infrastructure.

KPOT has appeared both as a standalone commodity stealer and as a component in broader criminal intrusion chains. It has been delivered through fake software installers, phishing-driven PowerShell downloaders, malvertising, and exploit-kit activity, and has also been observed as a secondary payload dropped by loaders such as Buer. In some campaigns it was deployed immediately before ransomware, suggesting credential theft and data collection were prioritized ahead of disruptive monetization. Delivery chains have included obfuscated scripts and in-memory execution, including AutoIt-assisted decryption and process hollowing into legitimate Windows processes to reduce on-disk visibility.

The malware is associated with cybercriminal use rather than a single exclusive operator. It has been sold as an off-the-shelf stealer in underground markets, bundled with supporting infrastructure services, and its source code was reportedly acquired by a REvil operator for further development. KPOT has also been cited as one of several stealers used in ransomware attack chains to provide access, credential material, and victim intelligence. The family targets Windows systems and is relevant across both consumer and enterprise environments because of its broad credential and wallet theft focus.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Stealth Mango

New Actor for win.kpot_stealer ... rule win_kpot_stealer_auto ... description = "Detects win.kpot_stealer." ... rule win_kpot_stealer_w0 { meta: description = "Kpot" type = "Stealer"

via malpediamalpedia.caad.fkie.fraunhofer.de

MITRE ATT&CK

Techniques & procedures

26 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1189Drive-by CompromiseEvidence2

...обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений, перепакованных и заражённых инсталляторов.

T1566PhishingEvidence3

Threat actors continue to use email as an infection method, with malicious documents or embedded malicious links. One approach is disguising the email as coming from the World Health Organization.

T1566.001Spearphishing AttachmentEvidence2

The emails state that the attachment contains important safety measures as directed from the WHO. These attachments have been seen to be an archive file, pdf, or doc.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

hxxp://show1[.]website/HeyaL.dat (AutoIt Interpreter) – Legitimate ... KPOT Deployed via AutoIt Script

T1059.001PowerShellEvidence2

In a previous write up, I documented a PowerShell downloader... Utilizing PowerShell to initiate infection chain

T1204User ExecutionEvidence1

「WSHSetup.exe」をユーザーが偽サイトからダウンロードして実行すると、「WSHSetup.exe」はtrynda[.]xyzという不正ドメインからfile1.exe〜file7.exeという7つのEXEファイルをダウンロード試行し、ダウンロードできたものを順に実行していきます。

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Process chain showing ‘dllhost.exe’ process hollowing

T1055.012Process HollowingEvidence2

The AutoIt script contains process hollowing shellcode ... that decrypts the encrypted PE file as guest and uses 32-bit dllhost.exe as host

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence1

hxxp://show1[.]website/OerAS.dat (Obfuscated AutoIt script, Base64 encoded as a certificate) ... Excerpt from Base64 decoded AutoIt script(‘i8ek7’) showing obfuscation

T1036MasqueradingEvidence3

CoronaVirusランサムウェアは、「WiseCleaner」という(およびそれに付随する)正規アプリケーションを装った偽ダウンロードサイトから配布されている偽インストーラーを実行することで最終的に感染するランサムウェアです。

T1055Process InjectionEvidence1

Process chain showing ‘dllhost.exe’ process hollowing

T1055.012Process HollowingEvidence2

The AutoIt script contains process hollowing shellcode ... that decrypts the encrypted PE file as guest and uses 32-bit dllhost.exe as host

T1070.004File DeletionEvidence1

その後、自身を終了して削除します。Kpotはシステムに永続的に起動させるような自動起動エントリーは作成しない点から、使い捨ての情報窃取マルウェアとして使用されていることがわかります。

T1140Deobfuscate/Decode Files or InformationEvidence1

The PowerShell script uses certutil to BASE64-decode the "certificate" to the AutoIt script

T1218System Binary Proxy ExecutionEvidence1

A legitimate, signed AutoIt interpreter (this is not malware)

T1620Reflective Code LoadingEvidence1

As the decrypted KPOT EXE is never written to disk, it was unknown by VirusTotal.

Credential Access

4 techniques

T1539Steal Web Session CookieEvidence1

Il est conçu pour collecter et exfiltrer des données sensibles présentes sur la machine compromise, notamment les identifiants enregistrés dans les navigateurs web, les cookies de session, les données de remplissage automatique, les informations relatives aux portefeuilles de cryptomonnaies ainsi que certains fichiers et paramètres système.

T1555Credentials from Password StoresEvidence5

KPOT is a classic "information stealer" that can extract and steal passwords from various apps on infected computers. | This includes web browsers, instant messengers, email clients, VPNs, RDP services, FTP apps, cryptocurrency wallets, and gaming software.

T1555.003Credentials from Web BrowsersEvidence1

One of AZORult’s main functions is stealing browser-saved credentials, and threat actors are claiming that Chrome’s move to hashing locally-saved password in the AES-256 algorithm thwarts AZORult’s best efforts to steal them.

T1649Steal or Forge Authentication CertificatesEvidence3

Kpotは感染すると、以下のようなあらゆるパスワードなどの認証情報を感染端末から盗み取ります。 Outlookの認証情報 Windows Mailの認証情報 ... VPNクライアントの認証情報 RDPの認証情報 ... ブラウザに保存されたWebサイトの認証情報やCookie

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Une fois exécuté, KPot Stealer réalise une reconnaissance du système infecté et recherche les applications susceptibles de contenir des informations exploitables.

T1518Software DiscoveryEvidence1

Une fois exécuté, KPot Stealer réalise une reconnaissance du système infecté et recherche les applications susceptibles de contenir des informations exploitables.

Collection

2 techniques

T1005Data from Local SystemEvidence3

Kpotは感染すると、以下のようなあらゆるパスワードなどの認証情報を感染端末から盗み取ります。 ... Skypeの認証情報やチャット履歴(main.db) ... 様々な仮想通貨の関連ファイル ... その他、Windowsに保存された認証情報など

T1213Data from Information RepositoriesEvidence1

KPOT is an infostealer, as can be guessed from the strings found inside the executable: ... And the targets:

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence3

Kpotは様々な認証情報の情報窃取を行ったあと、以下のC&Cに接続します。 trynda[.]xyz trynda1[.]xyz trynda2[.]xyz

T1105Ingress Tool TransferEvidence5

「WSHSetup.exe」はtrynda[.]xyzという不正ドメインからfile1.exe〜file7.exeという7つのEXEファイルをダウンロード試行し、ダウンロードできたものを順に実行していきます。

T1568Dynamic ResolutionEvidence1

As part of its behavioral flow, ElectroRAT contacts raw pastebin pages to retrieve the C&C IP address.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

Украденная информация отправляется на сайт злоумышленников.

INDICATORS OF COMPROMISE

IOCs tracked for this family

337 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

46 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

279 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app26 days ago

hash.md5●●●●●●●●●●●●View more in app26 days ago

hash.sha256●●●●●●●●●●●●View more in app26 days ago

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

sentinelone labsNews

Jul 15, 2026

Threat Intel | Cyber Attacks Leveraging the COVID-19/CoronaVirus Pandemic - SentinelLabs

Infostealer paired with CoronaVirus ransomware to harvest cryptocurrency wallets, browser data, and credentials.

intel471News

Jan 1, 2026

What malware to look for if you want to prevent a ransomware attack | Intel 471

Information stealer used in ransomware attacks.

intezer blogNews

Jan 1, 2026

ElectroRAT: Attacker Creates Fake Companies to Drain Crypto Wallets

An off-the-shelf stealer referenced through C2 infrastructure tied to the same operator or campaign artifacts.

reversethemalware blogNews

Aug 1, 2025

SHA-256 C2 ( Command and Control Server ) Hashes

Named malware/tool listed as detectable via SHA-256 hash in a compilation of attacker infrastructure and malware-related indicators.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching337

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping26

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

KPOT