Overview

overview

10

Static

static

10

IncomeTax_...pt.exe

windows7_x64

10

IncomeTax_...pt.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IncomeTax_PaymentReceipt.exe

  • Size

    1.3MB

  • Sample

    220211-na81haceh4

  • MD5

    0692f7369ad0e05cb31e083aefba8e1c

  • SHA1

    b2cf04e7983a1ed5b378475cfdf215b52de8d1ff

  • SHA256

    dc90482c940a4ab897dcb64e468ccc1767ce48c249755bb625d4e48e718edfd6

  • SHA512

    1cbdd7952e91aadd71f30c94c1467d17065cb7aae4c922fc904ca42fdb4ebcd8bfbfff291576b0f8b081ce92a6ebd9a4b6d1fe76ad8a7337d154cc79a03e9b87

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      IncomeTax_PaymentReceipt.exe

    • Size

      1.3MB

    • MD5

      0692f7369ad0e05cb31e083aefba8e1c

    • SHA1

      b2cf04e7983a1ed5b378475cfdf215b52de8d1ff

    • SHA256

      dc90482c940a4ab897dcb64e468ccc1767ce48c249755bb625d4e48e718edfd6

    • SHA512

      1cbdd7952e91aadd71f30c94c1467d17065cb7aae4c922fc904ca42fdb4ebcd8bfbfff291576b0f8b081ce92a6ebd9a4b6d1fe76ad8a7337d154cc79a03e9b87

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks