Overview

overview

10

Static

static

10

TDS Invoice.exe

windows7-x64

10

TDS Invoice.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    61b2dea87b12e821f4f0cbb6cb51bbf15a261b5d27b868b2450b32b68016b31a

  • Size

    349KB

  • Sample

    220730-y526jsfffn

  • MD5

    92f18c9332cba4f50a2b907316d57e25

  • SHA1

    4d3d45e6913485fee605ad5e88e7441bb21d1ce6

  • SHA256

    61b2dea87b12e821f4f0cbb6cb51bbf15a261b5d27b868b2450b32b68016b31a

  • SHA512

    0107da1e0c60c6633f3cec0a26f08146dfa8fc3f1d7091d2c070d3799a9e691e90016c0125771ac3deee8d4c6c2016b816d9fc55aa817e3663659f77cb5c6056

Score
10/10
kutakikeyloggerstealer

Malware Config

Targets

    • Target

      TDS Invoice.exe

    • Size

      840KB

    • MD5

      03d14d25935aabae662a09db5146ea35

    • SHA1

      e75ffa7ef6be023be366f95dedffff934e890f06

    • SHA256

      3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

    • SHA512

      3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks