kutaki | b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf

General

Target
b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
Size 636KB
Sample220724-y6vsvsfdgj
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3
SSDEEP 12288:FMeT4Ji0QKOGcyLcYqAJjUTQ18HcQtjOuRFQGSPI5eLXl:r+i0QKOGcHAqTQ1ejO+FQGmI5eLXl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://maregatu.club/paapoo/pove.php
http://terebinnahi.club/sec/kool.txt

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf

.exe 636KB

b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf

IMPHASH 36a0d307d8f05c8ef88f3f63ad3e20d3
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3
SSDEEP 12288:FMeT4Ji0QKOGcyLcYqAJjUTQ18HcQtjOuRFQGSPI5eLXl:r+i0QKOGcHAqTQ1ejO+FQGmI5eLXl
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

14632

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLateIdCall __vbaLenBstr __vbaStrVarMove ord696 __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord553 __vbaWriteFile ord660 __vbaLsetFixstr __vbaSetSystemError __vbaRecDestruct __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct __vbaLateMemSt ord591 __vbaVarIndexLoadRefLock ord593 __vbaBoolStr __vbaVarForInit ord300 ord594 __vbaObjSet ord595 __vbaOnError ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 ord306 __vbaForEachCollVar __vbaBoolVar __vbaStrFixstr ord520 ord707 __vbaStrTextCmp ord523 __vbaRefVarAry __vbaFpR8 __vbaVarTstLt __vbaBoolVarNull _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaPrintObj __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile __vbaInputFile ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 __vbaVarDiv ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaGetOwner4 ord534 __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 __vbaVarInt ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup ord613 __vbaFpI2 __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaVarCopy __vbaLateMemCallLd ord617 _CIatan ord618 __vbaAryCopy __vbaCastObj __vbaStrMove __vbaForEachVar ord619 __vbaR8IntI4 __vbaStrVarCopy _allmul __vbaLateIdSt ord545 __vbaVarTextCmpNe _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing