Overview

overview

10

Static

static

10

TDS Challan.exe

windows7_x64

10

TDS Challan.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40418497967b8c7c4d92587f9f34854f1eef670cb95a0908f066d81a7bcc3d96

  • Size

    368KB

  • Sample

    220708-y7es2affal

  • MD5

    d80d1245fc0bbaf5f6c799b12008d33c

  • SHA1

    3dc481b770eb4b562c61395df7e28298ea999cc4

  • SHA256

    40418497967b8c7c4d92587f9f34854f1eef670cb95a0908f066d81a7bcc3d96

  • SHA512

    f95b47f95b54aac15b0ab74abb45bf0d64360cf1de2b9f75de493721de38e8df0956a503a346871c12db0f09c1270c7788a6c206c64f700bf4b548fa95c56892

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      TDS Challan.exe

    • Size

      755KB

    • MD5

      645be265d5378cdfdda8a059a228b9a2

    • SHA1

      2d7816de252f0881583fce21ccd4ef2e9bfe1dff

    • SHA256

      a09fd5ecf91fcdc892b38fb7fb356a972134863f8b639f307d01d688d2e3c050

    • SHA512

      55ccb2dfdf6776550bda7b476bdaac6ba6dac2d97f215d57b0e164544befbabb8732006cc1d8920452553f38dc453f497266d12d184bee79bb2ce3f5c7702f7a

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks