Overview

overview

10

Static

static

10

TDS Challan.exe

windows7_x64

10

TDS Challan.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14f66c17db2c1ed89fdf14bb8bd1afd81ac66c71ab6f99fdb926f6dcaeba456b

  • Size

    377KB

  • Sample

    220609-kxztkaeadk

  • MD5

    13373efb78b70b7b16002868bb5b5880

  • SHA1

    cda4a4002e925e2e75396058cf65e2d99712be0f

  • SHA256

    14f66c17db2c1ed89fdf14bb8bd1afd81ac66c71ab6f99fdb926f6dcaeba456b

  • SHA512

    e4af02f95f4b17ef72a746f9e4383a01f39362dc5fb0b5a5036022d5b5d6be50ce018526c800c5d8f46d898bb76ce32abcc5218e6c68c4b89abcab0ba208fa2b

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      TDS Challan.exe

    • Size

      496KB

    • MD5

      9ca01142589187736ef32d73d28973e0

    • SHA1

      307faa96f8186c56e8f670860190e08129d43b5b

    • SHA256

      ac9fec69ac45137f4fc44b568af643e9dc34724e8a110d1f028650fe8e5914bb

    • SHA512

      9ad4906cd5ac83dbcbbe2bf875eb196ddc82d423ddc58c92feb44039d1f0620bfc26ba330eb4afd31d3a14d8094fb21ba30beb6ceba8f5980cf82e59252332de

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks