General

  • Target

    IncomeTax_Challan_Receipt.exe

  • Size

    656KB

  • Sample

    220905-cqcfpahdek

  • MD5

    7e2f0c09b110bbe733f16ae53896b39a

  • SHA1

    6892e6a98ce3291fc9c81976b9cea12853b01c23

  • SHA256

    84e3f0c265ad68515c39ce4eb91e19a2edf1307feb67300673b1945159eae024

  • SHA512

    55dab9dc9b4532988260d3af609b258ffd54f5e4a6149da2f61afe0688938c2b687fc0f53ed70175e1cf22365ce469a1a42e31f6991c7d655cde1ea913056ff8

  • SSDEEP

    12288:N7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750i46A9jmP/uhu/yc:5QkxZHV10DFikZdnNafmP/UDMS08Cknk

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Targets

    • Target

      IncomeTax_Challan_Receipt.exe

    • Size

      656KB

    • MD5

      7e2f0c09b110bbe733f16ae53896b39a

    • SHA1

      6892e6a98ce3291fc9c81976b9cea12853b01c23

    • SHA256

      84e3f0c265ad68515c39ce4eb91e19a2edf1307feb67300673b1945159eae024

    • SHA512

      55dab9dc9b4532988260d3af609b258ffd54f5e4a6149da2f61afe0688938c2b687fc0f53ed70175e1cf22365ce469a1a42e31f6991c7d655cde1ea913056ff8

    • SSDEEP

      12288:N7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750i46A9jmP/uhu/yc:5QkxZHV10DFikZdnNafmP/UDMS08Cknk

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks