General

  • Target

    eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

  • Size

    816KB

  • Sample

    220731-2mvwasbdh5

  • MD5

    91b01051c2b3fbb0507e76ec0bb8f329

  • SHA1

    49a1b1c6b58e29f842e54a4f03e5330b7f818fb6

  • SHA256

    eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

  • SHA512

    86f2d4941e1d779247c7929d0dd87bc4197332ce4ef33fbb0baa85f1476e78c5dd599c454ad45edfd39ccf928e6a42620c6b594af473845f296e9496376942eb

Malware Config

Targets

    • Target

      eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

    • Size

      816KB

    • MD5

      91b01051c2b3fbb0507e76ec0bb8f329

    • SHA1

      49a1b1c6b58e29f842e54a4f03e5330b7f818fb6

    • SHA256

      eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

    • SHA512

      86f2d4941e1d779247c7929d0dd87bc4197332ce4ef33fbb0baa85f1476e78c5dd599c454ad45edfd39ccf928e6a42620c6b594af473845f296e9496376942eb

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks