Overview

overview

10

Static

static

10

TDS Challan.exe

windows7_x64

10

TDS Challan.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b998760d65dba0cf8820f4743bda79310dea60a0926460f613ee4d90fa0c720

  • Size

    351KB

  • Sample

    220703-man5nahah7

  • MD5

    8c403b493985a5259b70945ba508c45e

  • SHA1

    f751dd469d0cf1efdbc40809dd2fc42f9db7989c

  • SHA256

    3b998760d65dba0cf8820f4743bda79310dea60a0926460f613ee4d90fa0c720

  • SHA512

    8030781b1b7d1c11eb070ae2357d4d79fb70594b6b8e50718df6f377fcba5704193bad2249982dae4b80e8466c8e8fdcc4900cbbfac1e68510e77e2e04ecb5a0

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      TDS Challan.exe

    • Size

      740KB

    • MD5

      1ba628a1b76f3a2f4133f94c7c18f91c

    • SHA1

      876664b10a1fc68dba94efbb6aaa9f8eae3d1fac

    • SHA256

      408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0

    • SHA512

      219a3a6e8cea16a58b90d7e2a044c4e7e26145e7e33c5a73033e382b2ccd8f8e16767af8af22f7f1db973733619a03e5cce1a4c2327f2d8f79db67f534f67e24

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks