Overview

overview

10

Static

static

10

NEFT_Payment.exe

windows7-x64

10

NEFT_Payment.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c6f03fe1e88eba449e3d525aebb408e4

  • Size

    1.1MB

  • Sample

    220725-e647raegh8

  • MD5

    c6f03fe1e88eba449e3d525aebb408e4

  • SHA1

    50f47e17d73e28e1df44af1f869ddc23ddddd650

  • SHA256

    56a6bca7c19df8d148d6662a92c118035254d929df721f4112b7f59aece15866

  • SHA512

    03da1c30f923e7297ba551d12646031c6f19860bf2c27991923f92e35ab973addcc4c50a49574f3ce7a91378d7a4f35a0caecc6143d83141c4ff5fb6fd3f5225

Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

kutaki

C2

http://ojorobia.club/laptop/laptop.php

http://terebinnahicc.club/sec/kool.txt

Targets

    • Target

      NEFT_Payment.exe

    • Size

      1.3MB

    • MD5

      28ef0988445cc4cdb59d31feca704df2

    • SHA1

      0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f

    • SHA256

      720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1

    • SHA512

      fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks