Overview

overview

10

Static

static

10

TDS Challan.exe

windows7_x64

10

TDS Challan.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1296e4f3c4f9a4475649f2aa811d3d79d46efccc3070e2073ba89b4d124fc1e3

  • Size

    436KB

  • Sample

    220603-sfnc7sadh5

  • MD5

    acc19594ebf97ac86421f08e40514fa4

  • SHA1

    5aacb791365cc34ac8acc3324f6e4077237b2b59

  • SHA256

    1296e4f3c4f9a4475649f2aa811d3d79d46efccc3070e2073ba89b4d124fc1e3

  • SHA512

    1877f942c39828f69103050a3db0bf4385f633e9c16b7c28443416f2f63e007967e6ff8934979260b77ab15b90e4c08bdf73e636289c3fe4a0c024685c7566a2

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      TDS Challan.exe

    • Size

      1.1MB

    • MD5

      bdfe1051fc246f74193f5e5c8749b7ec

    • SHA1

      78a61790dccb94853e233ec1f75db3ee6055b5de

    • SHA256

      62e4ce478f0bc615d11257a09a9ed68ae42c2ada0e4c62c548f1245befa04462

    • SHA512

      e1d1c9ce40de4e922f0a5c1bad4f565251fc3bc6d9e763b1d027f9a00edee9589c094a0586e9d87a49c3f6812e2ca4e6d7777f171502583dcc215900fc851de7

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks