KPOT info stealer samples

KPOT Stealer is a “stealer” malware that focuses on stealing account information and other data from various software applications and services

Download. Email me if you need the password (see in my profile)

Download 1  (from Didier Stevens' post)
Download 2  (Proofpoint)

Malware Inventory (work in progress)

Links updated: Jan 19, 2023

References

1.  2020-04-19 Didier Stevens posted analysis of KPOT infostealer on the Infosec Handlers Diary blog "KPOT Analysis: Obtaining the Decrypted KPOT EXE"

These are samples to follow his analysis routine.

2. 2019-05-09 Proofpoint. New KPOT v2.0 stealer brings zero persistence and in-memory features to silently steal credentials

Download

             Other malware - Airtable

Download. Email me if you need the password (see in my profile)

1. http://contagio.deependresearch.org/crime/kpotstealer_win_samp.zip from Didier Stevens' post
2. http://contagio.deependresearch.org/crime/kpotstealer(proofpoint)_win_samp.zip - Proofpoint

Hashes

1. From Didier Stevens' post

MD5  56ad7b243511ee7398d43df7643dc904
SHA-1  ae5ab7798ca267b1265a0496c562f219821d17cf
SHA-256  3fd4aa339bdfee23684ff495d884aa842165e61af85fd09411abfd64b9780146

2. From Proofpoint

MD5 7d7667ddce8fd69a0fd50bb08c287d10
SHA-1 087fc3e9a082983ee6a2b25f0ccb09eb723e0f39

SHA-256 67f8302a2fd28d15f62d6d20d748bfe350334e5353cbdef112bd1f8231b5599d

MD5 45ddc687f88b45fc3fec79f9dc8b38e2
SHA-1 de37b748e0e32d96c31f469f9ba4ea4f11e3e78b
SHA-256 36dcd40aee6a42b8733ec3390501502824f570a23640c2c78a788805164f77cecontagio.deependresearch.org/crime/kpotstealer(proofpoint)_win_samp.zip