MALICIOUS — 007_All.ElectroRAT.bin

MALICIOUS — 007_All.ElectroRAT.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the KpotStealer family. 5 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: dd1792bcdf560ebaa633f72de4037e78fe1ada5c8694b9d4879554aedc323ac9
SHA-1: 133877dd043578a2e9cbe1a4bf60259894288afa
MD5: 0468127a19daf4c7bc41015c5640fe1f
imphash: 8b847a7b9c8a22909cec12c67eb79951
ssdeep: 3072:5HYBf8YzKw/MHfBTU3eiu0B/qIbmuvFT8whrQnFW:5HY70Bou0B/q6IOrQnFW
TLSH: T15E3D4A4E02093788D5B7E6622D016EADE007F4B682FA391D6E03C17F3663C5799744AE
Submitted as: 007_All.ElectroRAT.bin
File type: pe · Size: 124616 bytes
Verdict: malicious (99/100) · Family: KpotStealer

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
Detect It Easy (packer/type): DIE:Microsoft Linker
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/KpotStealer.DHB!MTB
Emsisoft (Emergency Kit): Gen:Variant.Stealer.20

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Memory forensics: 5 finding(s), e.g. process hollowing in tsk_8500c5ca57 (pid 9072) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Microsoft Defender flagged Trojan:Win32/KpotStealer.DHB!MTB (rule Trojan:Win32/KpotStealer.DHB!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Stealer.20 (rule Gen:Variant.Stealer.20) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (2 HTTP) - network signal, weight 0.40, confidence 0.80
Extracted KoiLoader config (0 C2) - engine signal, weight 0.45, confidence 0.60
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

398 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

98845d3068fd6cfe4a75b1191bb2e7c7fe4fdfb1853498194848c98d47d3daff - 98845d3068fd6cfe4a75b1191bb2e7c7fe4fdfb1853498194848c98d47d3daff

Embedded URLs

https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/ssl-cps-repository.htm0
http://www.msftconnecttest.com/connecttest.txt

Embedded domains

cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com
inference.location.live.net
oneclient.sfx.ms

Embedded IP addresses

23.40.52.85
13.69.109.130
20.42.179.204
20.184.175.9
150.171.22.17
20.165.94.46
20.190.142.165
4.230.171.124
172.215.188.225
20.247.184.197
72.154.7.248
52.168.117.171
172.178.240.161
193.135.12.107
23.33.238.102
20.184.175.15
23.33.238.171
74.226.60.120
23.198.40.44
23.33.238.135
4.150.223.108
48.211.4.16
23.221.133.185
72.145.35.116
4.247.188.224

More KpotStealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report