General

  • Target

    5dafc0d99ebc6584452879c16ce9f7eee7fbd3d4773c74005f7bcea1811da5ae

  • Size

    402KB

  • Sample

    220731-2mwslabdh6

  • MD5

    5432e3a077c785346c69fcba8fc7b62a

  • SHA1

    3f1be4618cdd55780efc334a4cc57edb0670b718

  • SHA256

    5dafc0d99ebc6584452879c16ce9f7eee7fbd3d4773c74005f7bcea1811da5ae

  • SHA512

    5eb91cc7898734aff27c7ebf0994ffc964d04c9bcfd12190ad4a7bee9fe21c30471ad634d5c48cabdcb9c5ef6f26801e18c39e7390d60779440eca79e74d55e9

Malware Config

Targets

    • Target

      TDS Challan.exe

    • Size

      816KB

    • MD5

      91b01051c2b3fbb0507e76ec0bb8f329

    • SHA1

      49a1b1c6b58e29f842e54a4f03e5330b7f818fb6

    • SHA256

      eff15e66863ace3fd44f4fa3fdbe15a15d29b750efe97224134287e097ada5a0

    • SHA512

      86f2d4941e1d779247c7929d0dd87bc4197332ce4ef33fbb0baa85f1476e78c5dd599c454ad45edfd39ccf928e6a42620c6b594af473845f296e9496376942eb

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks