General

  • Target

    3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

  • Size

    840KB

  • Sample

    220625-gsdhzsbab9

  • MD5

    03d14d25935aabae662a09db5146ea35

  • SHA1

    e75ffa7ef6be023be366f95dedffff934e890f06

  • SHA256

    3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

  • SHA512

    3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

Malware Config

Targets

    • Target

      3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

    • Size

      840KB

    • MD5

      03d14d25935aabae662a09db5146ea35

    • SHA1

      e75ffa7ef6be023be366f95dedffff934e890f06

    • SHA256

      3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

    • SHA512

      3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks