kutaki | 53e5bb2398ff5857e45c9ebeb3fe9bfd0a8d6a4809321582739bba553b66879c

General

Target
53e5bb2398ff5857e45c9ebeb3fe9bfd0a8d6a4809321582739bba553b66879c
Size 496KB
Sample220726-xbb7lagag7
SHA256 53e5bb2398ff5857e45c9ebeb3fe9bfd0a8d6a4809321582739bba553b66879c
MD5 233f566a89d2146231487344b879bd75
SHA1 8b88e7b039eeab0f6c29db4870c021b084a23b53
SHA512 c2067b79c27147f5fcdca3c6e56f043189f966ebcef82318bca08a8dbfeeb2bac35c16109881c3dae426f827f98c146aa42046820a9939e22b5b5ffe33e84e3f
SSDEEP 12288:WmX73d1f7iKXyC28gj9t8IbeTWPMlSpwhaGsPdiySW7:Fp1fNiwgj9t5beRlSpv14yr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/Tax Payment Challan.exe	family_kutaki

Kutaki family
kutaki

File Explorer

53e5bb2398ff5857e45c9ebeb3fe9bfd0a8d6a4809321582739bba553b66879c

.zip 496KB
Tax Payment Challan.exe

.exe 795KB

53e5bb2398ff5857e45c9ebeb3fe9bfd0a8d6a4809321582739bba553b66879c

SHA256 53e5bb2398ff5857e45c9ebeb3fe9bfd0a8d6a4809321582739bba553b66879c
MD5 233f566a89d2146231487344b879bd75
SHA1 8b88e7b039eeab0f6c29db4870c021b084a23b53
SHA512 c2067b79c27147f5fcdca3c6e56f043189f966ebcef82318bca08a8dbfeeb2bac35c16109881c3dae426f827f98c146aa42046820a9939e22b5b5ffe33e84e3f
SSDEEP 12288:WmX73d1f7iKXyC28gj9t8IbeTWPMlSpwhaGsPdiySW7:Fp1fNiwgj9t5beRlSpv14yr
MD5 SHA1 SHA512 SSDEEP

Tax Payment Challan.exe

IMPHASH 8b16bae324b6900af714c2056845c1c7
SHA256 bd83761e9710a92a9b0b60a85c87f5aa2a27d30a8cff821e65df95d323d5b3d4
MD5 17c53a651b72616b46ecb8f5215ed009
SHA1 c426cc3a5e333bafb8e0b0ed78515dc003da31c6
SHA512 c2abab756d7351f819340857d1f500e7344838d28f744de6db39d5e3021b4382be3920b77985f057404f6b6206f09010f2bd0b2fcb61a944276145acf375c5c6
SSDEEP 12288:XHSWNBEEEEEEEEEEEEmP0l9LmmvTpp+5NvHzlK7KqufBEVlEpTfTdTrTKTXTcTff:z9LmmrYrIRqrlSpnHuGE5
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

12764

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaLateIdCall ord696 __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaStrCat __vbaVarCmpNe __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit __vbaBoolStr ord593 ord300 ord594 __vbaStrLike __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord306 __vbaStrFixstr ord520 __vbaForEachCollVar __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull __vbaVarTstLt _CIsin __vbaErase __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaObjVar __vbaI2I4 __vbaNextEachCollVar DllFunctionCall ord563 ord670 __vbaVarLateMemSt __vbaVarOr ord564 __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaAryLock __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaCheckTypeVar __vbaVarMod __vbaFpI4 ord616 __vbaVarLateMemCallLd __vbaVarCopy __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaI2ErrVar __vbaForEachVar ord619 __vbaStrVarCopy _allmul _CItan __vbaAryUnlock __vbaUI1Var __vbaFPInt __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing