General

  • Target

    160a47ca32310b4bc311587ab0a6063b

  • Size

    1.1MB

  • Sample

    220616-lv3ywadgek

  • MD5

    160a47ca32310b4bc311587ab0a6063b

  • SHA1

    726393dfe0ccddcfaea46b16d157ae7365b0b8e3

  • SHA256

    a00ebee4aeb320636bfd6035f12813f516bfac8ed12f4534f989d40ad56f16e6

  • SHA512

    3cc3e33983b545989b19e976509484ae2c46912b17a57a8f4c68863807d5777a76cbf47ff3320965a3bc6f2d6b0ad2e19e4b92f1cc5d2edc10c48408931ecc92

Malware Config

Targets

    • Target

      Tax Payment Challan.exe

    • Size

      3.7MB

    • MD5

      5f25cb32cb11c4e4983d85bf95aee8f1

    • SHA1

      cd7ec29d9a162ac4ffd453c2beafae52767a3739

    • SHA256

      99229a496b7b21bc5385bf85b68358418a5e3554740fa8ed14d355c5bc25997d

    • SHA512

      bd528327be04e93c074175cf415fdb75811d951eaf4fb752c1bc56cd843292ae8c10357a6b66745179d5007ad31867e83aeaa82b61f6165090e368a0c9332987

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks