KPOT Stealer

KPOT Stealer is a Windows information-stealing malware family sold in cybercrime markets and used in criminal delivery campaigns since at least 2018. It is designed to collect and exfiltrate credentials, cookies, autofill data, account information, and other sensitive artifacts from a broad set of applications, including web browsers, instant messengers, email clients, VPN software, remote access tools, FTP clients, cryptocurrency wallets, and gaming platforms. Documented targets include Chrome, Firefox, Internet Explorer, Outlook, Skype, Telegram, Discord, Steam, Battle.net, WinSCP, FileZilla, RDP-related data, Windows credentials, and multiple cryptocurrency applications and wallets.

Technically, KPOT is written in C/C++ and commonly employs packed samples, encrypted strings, and runtime API resolution to hinder analysis. Important strings are stored in encrypted form and decrypted with XOR-based routines at runtime. The malware resolves Windows APIs dynamically by parsing the PEB and hashing export names with a Murmur3-based algorithm, avoiding straightforward static imports. It communicates with command-and-control infrastructure over HTTP, retrieves tasking and configuration data, and exfiltrates collected results in encrypted form. Observed tasking includes theft of browser and application data, screenshot capture, collection of host profiling information, and file theft based on server-supplied grabber rules. Some analyzed variants also perform a geographic check and terminate on systems located in CIS countries.

Observed delivery has included email campaigns, exploit-kit activity, and malicious software download chains. One documented infection chain used a malicious RTF attachment exploiting CVE-2017-11882 to stage a downloader and ultimately deploy KPOT. The malware has also been distributed through compromised websites that replaced legitimate software downloads with trojanized installers. TA578 has been observed delivering KPOT in email-based campaigns alongside other crimeware families. In analyzed cases, some samples lacked a persistence mechanism and instead executed assigned tasks, posted results, and exited.