kutaki | 6fd414d974b96063ba79b7db323beb7b[.]zip

General

Target
6fd414d974b96063ba79b7db323beb7b.zip
Size 488KB
Sample220905-mg376ahhd2
SHA256 b47dc07388cf0646f0cc080abaebd9e357b188f2f4b8d6de0c7a3e67b989a718
MD5 6fd414d974b96063ba79b7db323beb7b
SHA1 a2939c89acb646a68389464f7abe8a50fc85929a
SHA512 4629731160b8415eab20f3315584866550b026b0b30a8cd8bc93d104e5ef06e8ca1c98f6a17f429c8ded7d60d53e54e5a85403843d490b639bbfcd0582af11a8
SSDEEP 12288:nzYHnreANRXD10DSAhO746A9jmd/uhSDyM408CknhFYR4:kZD10Dhfmd/UBM408CknLH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/Income_Tax_Receipt.exe	family_kutaki

Kutaki family
kutaki

File Explorer

6fd414d974b96063ba79b7db323beb7b.zip

.zip 488KB
Income_Tax_Receipt.exe

.exe 656KB

6fd414d974b96063ba79b7db323beb7b.zip

SHA256 b47dc07388cf0646f0cc080abaebd9e357b188f2f4b8d6de0c7a3e67b989a718
MD5 6fd414d974b96063ba79b7db323beb7b
SHA1 a2939c89acb646a68389464f7abe8a50fc85929a
SHA512 4629731160b8415eab20f3315584866550b026b0b30a8cd8bc93d104e5ef06e8ca1c98f6a17f429c8ded7d60d53e54e5a85403843d490b639bbfcd0582af11a8
SSDEEP 12288:nzYHnreANRXD10DSAhO746A9jmd/uhSDyM408CknhFYR4:kZD10Dhfmd/UBM408CknLH
MD5 SHA1 SHA512 SSDEEP

Income_Tax_Receipt.exe

IMPHASH f38744fbb9b3a05749b08f3b898505d3
SHA256 8f541e14c1eae40515b2abc8bb11aa584cd754f668eec02f6a2bf7974d686357
MD5 d039b5c37d260eda505b03f97b963b3a
SHA1 f7d4b2a09d147cc05d63f8ae20f6e72ad0912bbb
SHA512 935c665290617855d4a60ba6b2a458a4d3cc086893df8549101fd04f704d00b57c4460981c20fb6a701ae73a776dddf7f2823d0a466590bbcb68298e1500e9d7
SSDEEP 12288:j7k+QuuMas9dpZHV10DSpbgJ2y+OC1HwJ5tChW4kZdnNrv750F46A9jmP/uhu/y8:vQkxZHV10DFikZdnNxfmP/UDMS08Ckn0
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

13396

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaLenBstr __vbaStrVarMove ord696 __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 ord594 __vbaOnError ord595 __vbaObjSet ord596 _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 ord309 __vbaFpR8 __vbaBoolVarNull __vbaRefVarAry _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd __vbaLateIdCallSt EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord314 ord713 _adj_fprem _adj_fdivr_m64 ord315 ord714 ord607 ord316 ord608 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaR8Str __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaFreeVarg __vbaVarDup __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaAryCopy ord618 __vbaStrMove __vbaForEachVar ord619 __vbaR8IntI4 __vbaStrVarCopy _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing