kutaki | c673b09e0527528bbd30c5d03b7af463[.]zip

General

Target
c673b09e0527528bbd30c5d03b7af463.zip
Size 422KB
Sample220906-a3gvtsceb7
SHA256 03e067b68230dd9da8e74c905e862dd1f7c094a35606405d4e426f8ba02981bc
MD5 c673b09e0527528bbd30c5d03b7af463
SHA1 48e5b652d16a4eddb07ae119638a504ba477a486
SHA512 2b64a045aa3812515c183b07b8b7f171bdde94e79e9cc13cccce0713c836edd8ebef958ed232ddb6d191fa022115df2eb8790b2ff9bc6cc928c5deddcb3b2701
SSDEEP 12288:pokf0ngJ6K36HBx04cA9jmd/uhoVyM+08CknJTYR8:pSK6o6HBtJmd/UZM+08CknpJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/Payment_Receipt.exe	family_kutaki

Kutaki family
kutaki

File Explorer

c673b09e0527528bbd30c5d03b7af463.zip

.zip 422KB
Payment_Receipt.exe

.exe 812KB

c673b09e0527528bbd30c5d03b7af463.zip

SHA256 03e067b68230dd9da8e74c905e862dd1f7c094a35606405d4e426f8ba02981bc
MD5 c673b09e0527528bbd30c5d03b7af463
SHA1 48e5b652d16a4eddb07ae119638a504ba477a486
SHA512 2b64a045aa3812515c183b07b8b7f171bdde94e79e9cc13cccce0713c836edd8ebef958ed232ddb6d191fa022115df2eb8790b2ff9bc6cc928c5deddcb3b2701
SSDEEP 12288:pokf0ngJ6K36HBx04cA9jmd/uhoVyM+08CknJTYR8:pSK6o6HBtJmd/UZM+08CknpJ
MD5 SHA1 SHA512 SSDEEP

Payment_Receipt.exe

IMPHASH 92ea9227782f0ce87ec7d6acf15fa241
SHA256 c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a
MD5 fad8c7f1f023b519a8bc97f44c845f1b
SHA1 e305349bd0dda9732aaab10499153d6e80ce11bc
SHA512 ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3
SSDEEP 12288:jw/h2mDPAtjj4cv6aiUoIxbU546A9jmP/uhu/yMS08CkntxYRK:EPmjj4cZfmP/UDMS08Ckn3n
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

17232

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaResume __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord552 ord553 ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB ord662 __vbaHresultCheckObj ord557 __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar __vbaVarTstLe ord667 Zombie_GetTypeInfo __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaLateMemSt ord593 __vbaVarForInit __vbaExitProc __vbaForEachCollObj ord594 __vbaObjSet __vbaOnError ord595 ord596 _adj_fdiv_m16i ord702 __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 __vbaForEachCollVar ord520 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaNextEachCollObj __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 ord560 __vbaDateR8 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaCastObjVar __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord606 ord713 __vbaDateStr _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaCheckType __vbaI2Var ord644 ord537 ord645 ord538 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaVar2Vec __vbaInStr __vbaVarLateMemCallLdRf __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaVarSetObj __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt ord575 __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrComp __vbaFreeVarg ord612 __vbaStrToAnsi __vbaVarDup ord613 __vbaFpI2 __vbaFpI4 ord616 __vbaVarLateMemCallLd __vbaRecDestructAnsi ord617 __vbaLateMemCallLd _CIatan __vbaAryCopy ord618 __vbaStrMove __vbaCastObj __vbaForEachVar __vbaR8IntI4 __vbaStrVarCopy ord619 ord542 ord650 ord543 _allmul ord544 __vbaLateIdSt ord545 _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing