Overview

overview

10

Static

static

10

HDFC Tax P...ed.exe

windows7-x64

10

HDFC Tax P...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HDFC Tax Payment Attached_1.zip

  • Size

    332KB

  • Sample

    220909-hysersgff5

  • MD5

    549dcf693379a2a4afa76bb321caff0b

  • SHA1

    4a31a8fe53d1c54f9064caa941a8872de1138c88

  • SHA256

    a4ce28e86378c0ea7453ffd0fe06e738e014133d598845ab8c62d76b7dd26ef8

  • SHA512

    50a7742269a1bebc450648562aa146f3c246aa5af378f38c86e8989366a9171b4889eaea239b32bce1c294b8b36a79fdbfa21234a1920bc93afd2e7c8a1fcb9d

  • SSDEEP

    6144:zis8hbMKLBZ6EdLRW4Es+CSNw6svzOjSaR9K26odl0TZuwnDD0zgffC1aGJhCjdq:27bFvdVB4NYv6jf9KMa/DtC11uU

Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Targets

    • Target

      HDFC Tax Payment Attached.exe

    • Size

      408KB

    • MD5

      f2d9b19707c3356037cb197852fe938d

    • SHA1

      44e2604986ee12516c7a53226885eb062e70fb19

    • SHA256

      793b8eebc54d69cd4e7e80400d55bc97dda0ff3836c39eec8c67a00285bdd722

    • SHA512

      1a9de6ca3b77396792dc3914dcef44f00dec10ed2d51bcb7721c61756a290260523017de20a257a1e09969155208471967f5e2bd4ef34940b71d2f1e87709db0

    • SSDEEP

      6144:Bx9Xwhm7c/n10V7c5W4Es+CS/wUcvzUjSa5pK2mKdl0TruunfD09gfJChgGJhCj:BbXwhm7a1NB4/8vYjDpK8atfx8hDu

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks