General

  • Target

    c673b09e0527528bbd30c5d03b7af463

  • Size

    812KB

  • Sample

    220906-a4yvqshehl

  • MD5

    fad8c7f1f023b519a8bc97f44c845f1b

  • SHA1

    e305349bd0dda9732aaab10499153d6e80ce11bc

  • SHA256

    c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a

  • SHA512

    ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3

  • SSDEEP

    12288:jw/h2mDPAtjj4cv6aiUoIxbU546A9jmP/uhu/yMS08CkntxYRK:EPmjj4cZfmP/UDMS08Ckn3n

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Targets

    • Target

      c673b09e0527528bbd30c5d03b7af463

    • Size

      812KB

    • MD5

      fad8c7f1f023b519a8bc97f44c845f1b

    • SHA1

      e305349bd0dda9732aaab10499153d6e80ce11bc

    • SHA256

      c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a

    • SHA512

      ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3

    • SSDEEP

      12288:jw/h2mDPAtjj4cv6aiUoIxbU546A9jmP/uhu/yMS08CkntxYRK:EPmjj4cZfmP/UDMS08Ckn3n

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks