1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
rule kpot
{
meta:
author = " J from THL <j@techhelplist.com>"
date = "2018-08-29"
reference1 = "https://www.virustotal.com/#/file/4e87a0794bf73d06ac1ce4a37e33eb832ff4c89fb9e4266490c7cef9229d27a7/detection"
reference2 = "ETPRO TROJAN KPOT Stealer Check-In [2832358]"
reference3 = "ETPRO TROJAN KPOT Stealer Exfiltration [2832359]"
version = 1
maltype = "Stealer"
filetype = "memory"
strings:
$text01 = "bot_id=%s"
$text02 = "x64=%d"
$text03 = "is_admin=%d"
$text04 = "IL=%d"
$text05 = "os_version=%d"
$text06 = "IP: %S"
$text07 = "MachineGuid: %s"
$text08 = "CPU: %S (%d cores)"
$text09 = "RAM: %S MB"
$text10 = "Screen: %dx%d"
$text11 = "PC: %s"
$text12 = "User: %s"
$text13 = "LT: %S (UTC+%d:%d)"
$text14 = "%s/%s.php"
$text15 = "Host: %s"
$text16 = "username_value"
$text17 = "password_value"
$text18 = "name_on_card"
$text19 = "last_four"
$text20 = "exp_month"
$text21 = "exp_year"
$text22 = "bank_name"
condition:
16 of them
}