Overview

overview

10

Static

static

10

Payment Receipt.exe

windows7_x64

10

Payment Receipt.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c1e2dfa09d2c6087a2efaf78eb801cdc75359bfc5889e7c7fe73593028cc620

  • Size

    338KB

  • Sample

    220208-cb2f9sbhg5

  • MD5

    9d8ea85e86398f761c856133878d2f00

  • SHA1

    0c5e508909f7be110ac8294f46fe56b076c9ab36

  • SHA256

    3c1e2dfa09d2c6087a2efaf78eb801cdc75359bfc5889e7c7fe73593028cc620

  • SHA512

    cd86b37e0f15ab7b1d703ebfe562a4d0ee9b5c441375cb6fa96655df230eb33e58fcf3819ad856d57fb996fe89277893a801214c7f52631973051421d16e26c4

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      Payment Receipt.exe

    • Size

      532KB

    • MD5

      f94a939bae7c5e1d897253f792b052f7

    • SHA1

      e21bfa3434858b47269ffbc5953760fefc9a7aec

    • SHA256

      f0d9268622a5e43c670ccc556495668967dac426fab571b78aaf1c61632f633c

    • SHA512

      7a8494329b238a7bed09ce32a247f1075f2e91b690b7c38e8417590a20233cbf382c2fbc8ab3cb6d0dcc0e8677934761db39659e8987f46c9c603ab909eb2f97

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks