General

  • Target

    0947b3ecce068d697ef61087acdf9791

  • Size

    1.2MB

  • Sample

    220801-mpdmgafdg2

  • MD5

    0947b3ecce068d697ef61087acdf9791

  • SHA1

    2d0b73fa23441479fe328df4384ea1bde8835392

  • SHA256

    2b322f4e53d8e70e2f3a53d4024b2f96fb029e0563c78f1efc0e18f742a5c5a5

  • SHA512

    453ae643d0c56a431c22c9fb120b4c48077630b7249879268fb60284a5c66e7345624ef829ecc8fbc05cafd330a665d1ae9cca768e9dff4d1b0abab9b88562b3

Malware Config

Extracted

Family

kutaki

C2

http://ojorobia.club/laptop/laptop.php

http://terebinnahicc.club/sec/kool.txt

Targets

    • Target

      NEFT_Payment.exe

    • Size

      2.6MB

    • MD5

      70e966394bf9947ff01b681bab9d0f71

    • SHA1

      53946411e4e975a9ed354b16cd22041108e9f596

    • SHA256

      c7e3deb446233da1eb6c6df66913065773d510a21750a9ea675b69be46ab245a

    • SHA512

      a71a0b9b265b3c31c01305b121b386b8beb14cb6f670df4cbdad3d2fb7a3b3c508b25b48b253cba4c9aacde77e47fc32481fdc4cfc9221af83ea90ab7a6fc200

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks