MalwareUsed by 1 actor

KPOT

KPOT is a commercially distributed information-stealing malware family targeting Windows, first observed in 2018. It harvests passwords and sensitive user data from web browsers, email clients, instant messengers, VPN software, RDP services, FTP applications, gaming clients, and cryptocurrency and electronic-payment wallets. Its collection capabilities include browser cookies, Telegram session data, chat histories, and cryptocurrency-related files. KPOT profiles compromised systems and sends stolen information to attacker-controlled infrastructure.

KPOT has been delivered through phishing emails, malicious PowerShell downloaders, counterfeit software installers, and malvertising campaigns using the Fallout Exploit Kit. Buer Loader has deployed it alongside Amadey and Smoke Loader. In a 2020 campaign, a counterfeit WiseCleaner download site distributed an installer that executed KPOT before CoronaVirus ransomware. Other observed delivery chains used a legitimate AutoIt interpreter and an obfuscated script to decrypt KPOT in memory and execute it through process hollowing, avoiding writing the decrypted payload to disk. KPOT samples also use encoded strings to conceal command-and-control and collection-related information. In the CoronaVirus campaign, KPOT did not establish autorun persistence and deleted itself after execution.

KPOT was sold through Russian-speaking cybercrime communities as an off-the-shelf stealer. A REvil operator known as UNKN purchased the source code for KPOT 2.0 at an underground auction in 2020. This acquisition links the family to the ransomware ecosystem but does not establish that subsequent REvil tooling incorporated KPOT.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Stealth Mango

New Actor for win.kpot_stealer ... rule win_kpot_stealer_auto ... description = "Detects win.kpot_stealer." ... rule win_kpot_stealer_w0 { meta: description = "Kpot" type = "Stealer"

via malpediamalpedia.caad.fkie.fraunhofer.de

MITRE ATT&CK

Techniques & procedures

26 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1189Drive-by CompromiseEvidence2

...обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений, перепакованных и заражённых инсталляторов.

T1566PhishingEvidence3

Threat actors continue to use email as an infection method, with malicious documents or embedded malicious links. One approach is disguising the email as coming from the World Health Organization.

T1566.001Spearphishing AttachmentEvidence2

The emails state that the attachment contains important safety measures as directed from the WHO. These attachments have been seen to be an archive file, pdf, or doc.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

hxxp://show1[.]website/HeyaL.dat (AutoIt Interpreter) – Legitimate ... KPOT Deployed via AutoIt Script

T1059.001PowerShellEvidence2

In a previous write up, I documented a PowerShell downloader... Utilizing PowerShell to initiate infection chain

T1204User ExecutionEvidence1

「WSHSetup.exe」をユーザーが偽サイトからダウンロードして実行すると、「WSHSetup.exe」はtrynda[.]xyzという不正ドメインからfile1.exe〜file7.exeという7つのEXEファイルをダウンロード試行し、ダウンロードできたものを順に実行していきます。

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

Process chain showing ‘dllhost.exe’ process hollowing

T1055.012Process HollowingEvidence2

The AutoIt script contains process hollowing shellcode ... that decrypts the encrypted PE file as guest and uses 32-bit dllhost.exe as host

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence1

hxxp://show1[.]website/OerAS.dat (Obfuscated AutoIt script, Base64 encoded as a certificate) ... Excerpt from Base64 decoded AutoIt script(‘i8ek7’) showing obfuscation

T1036MasqueradingEvidence3

CoronaVirusランサムウェアは、「WiseCleaner」という(およびそれに付随する)正規アプリケーションを装った偽ダウンロードサイトから配布されている偽インストーラーを実行することで最終的に感染するランサムウェアです。

T1055Process InjectionEvidence1

Process chain showing ‘dllhost.exe’ process hollowing

T1055.012Process HollowingEvidence2

The AutoIt script contains process hollowing shellcode ... that decrypts the encrypted PE file as guest and uses 32-bit dllhost.exe as host

T1070.004File DeletionEvidence1

その後、自身を終了して削除します。Kpotはシステムに永続的に起動させるような自動起動エントリーは作成しない点から、使い捨ての情報窃取マルウェアとして使用されていることがわかります。

T1140Deobfuscate/Decode Files or InformationEvidence1

The PowerShell script uses certutil to BASE64-decode the "certificate" to the AutoIt script

T1218System Binary Proxy ExecutionEvidence1

A legitimate, signed AutoIt interpreter (this is not malware)

T1620Reflective Code LoadingEvidence1

As the decrypted KPOT EXE is never written to disk, it was unknown by VirusTotal.

Credential Access

4 techniques

T1539Steal Web Session CookieEvidence1

Il est conçu pour collecter et exfiltrer des données sensibles présentes sur la machine compromise, notamment les identifiants enregistrés dans les navigateurs web, les cookies de session, les données de remplissage automatique, les informations relatives aux portefeuilles de cryptomonnaies ainsi que certains fichiers et paramètres système.

T1555Credentials from Password StoresEvidence5

KPOT is a classic "information stealer" that can extract and steal passwords from various apps on infected computers. | This includes web browsers, instant messengers, email clients, VPNs, RDP services, FTP apps, cryptocurrency wallets, and gaming software.

T1555.003Credentials from Web BrowsersEvidence1

One of AZORult’s main functions is stealing browser-saved credentials, and threat actors are claiming that Chrome’s move to hashing locally-saved password in the AES-256 algorithm thwarts AZORult’s best efforts to steal them.

T1649Steal or Forge Authentication CertificatesEvidence3

Kpotは感染すると、以下のようなあらゆるパスワードなどの認証情報を感染端末から盗み取ります。 Outlookの認証情報 Windows Mailの認証情報 ... VPNクライアントの認証情報 RDPの認証情報 ... ブラウザに保存されたWebサイトの認証情報やCookie

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Une fois exécuté, KPot Stealer réalise une reconnaissance du système infecté et recherche les applications susceptibles de contenir des informations exploitables.

T1518Software DiscoveryEvidence1

Une fois exécuté, KPot Stealer réalise une reconnaissance du système infecté et recherche les applications susceptibles de contenir des informations exploitables.

Collection

2 techniques

T1005Data from Local SystemEvidence3

Kpotは感染すると、以下のようなあらゆるパスワードなどの認証情報を感染端末から盗み取ります。 ... Skypeの認証情報やチャット履歴(main.db) ... 様々な仮想通貨の関連ファイル ... その他、Windowsに保存された認証情報など

T1213Data from Information RepositoriesEvidence1

KPOT is an infostealer, as can be guessed from the strings found inside the executable: ... And the targets:

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence3

Kpotは様々な認証情報の情報窃取を行ったあと、以下のC&Cに接続します。 trynda[.]xyz trynda1[.]xyz trynda2[.]xyz

T1105Ingress Tool TransferEvidence5

「WSHSetup.exe」はtrynda[.]xyzという不正ドメインからfile1.exe〜file7.exeという7つのEXEファイルをダウンロード試行し、ダウンロードできたものを順に実行していきます。

T1568Dynamic ResolutionEvidence1

As part of its behavioral flow, ElectroRAT contacts raw pastebin pages to retrieve the C&C IP address.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence3

Украденная информация отправляется на сайт злоумышленников.

INDICATORS OF COMPROMISE

IOCs tracked for this family

337 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

46 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

279 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

hash.md5●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

21 SOURCESView more in app

sentinelone labsNews

Jul 15, 2026

Threat Intel | Cyber Attacks Leveraging the COVID-19/CoronaVirus Pandemic - SentinelLabs

Infostealer paired with CoronaVirus ransomware to harvest cryptocurrency wallets, browser data, and credentials.

intel471News

Jan 1, 2026

What malware to look for if you want to prevent a ransomware attack | Intel 471

Information stealer used in ransomware attacks.

intezer blogNews

Jan 1, 2026

ElectroRAT: Attacker Creates Fake Companies to Drain Crypto Wallets

An off-the-shelf stealer referenced through C2 infrastructure tied to the same operator or campaign artifacts.

pwcNews

Dec 3, 2025

From KPOT to Koi | PwC

Mentioned as an example of a retired malware family whose evolutions may be detected through reused code and configuration overlaps. Its capabilities and a direct relationship to Koi are not established in the excerpt.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching337

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping26

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

KPOT