kutaki | HDFC Payment Receipt[.]exe

General

Target
HDFC Payment Receipt.exe
Size 536KB
Sample220906-m7zbwsbge7
SHA256 5587ae6cef689c180254ba9d455eb62c171c4bbb20f82af7450ea2eeff4eac1e
MD5 2a189ba5e989daca58342a7dd038b142
SHA1 abbaecc7acad08d1163a452cb56aa1d71c3582f8
SHA512 f22d03a70d3177096acb5f62f9f6949df2478cb7d2dea40fc2057b6f8ebf8bc28320f23e1c9a4edd92753baa989cea7d19482582a6d5878d3e9815c0ab800baa
SSDEEP 6144:NT1htGytvUf4yclQgx7+8DfpedxbKT3F9opcVyUW4Es+CS/wUcvzUjSa5pK2mKd4:7P+8DpFTvodUB4/8vYjDpK8atfx8hDu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

HDFC Payment Receipt.exe

.exe 536KB

HDFC Payment Receipt.exe

IMPHASH 9c85b26cee7172133f71ba7e45cca754
SHA256 5587ae6cef689c180254ba9d455eb62c171c4bbb20f82af7450ea2eeff4eac1e
MD5 2a189ba5e989daca58342a7dd038b142
SHA1 abbaecc7acad08d1163a452cb56aa1d71c3582f8
SHA512 f22d03a70d3177096acb5f62f9f6949df2478cb7d2dea40fc2057b6f8ebf8bc28320f23e1c9a4edd92753baa989cea7d19482582a6d5878d3e9815c0ab800baa
SSDEEP 6144:NT1htGytvUf4yclQgx7+8DfpedxbKT3F9opcVyUW4Es+CS/wUcvzUjSa5pK2mKd4:7P+8DpFTvodUB4/8vYjDpK8atfx8hDu
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

13712

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt __vbaStrI2 ord690 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaLateIdCall ord696 __vbaPut3 __vbaEnd __vbaVarIdiv __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaRaiseEvent __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 ord594 ord595 __vbaObjSet __vbaOnError ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaBoolVar __vbaFpR8 __vbaBoolVarNull __vbaRefVarAry _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 __vbaLateIdStAd ord608 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaR8Str __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrToAnsi __vbaStrComp __vbaVarDup __vbaVerifyVarObj __vbaVarLateMemCallLd ord616 __vbaFpI4 ord617 __vbaLateMemCallLd _CIatan __vbaAryCopy ord618 __vbaStrMove __vbaCastObj __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing