kutaki

Resubmissions

17/09/2022, 21:15

220917-z36avsace410

12/09/2022, 07:51

220912-jptrxacge810

Sharing

Copy URL Twitter E-mail

General

Target
Payment Confirmation Invoice.exe
Size 408KB
Sample220912-jptrxacge8
SHA256 29b194f5409b24a2bdf4b74f35e13a73e7e133dab36339f7b2cc9a0e4f007e17
MD5 226bea0278f6534c83992d1ceac1c211
SHA1 b1a3df7bedbb45b0a2df9e575293d795996da01a
SHA512 e889315f6609ace41811e0f7379cccb802b0ed3012337f9653241b3a0bdaf9b9bf523b9134b2e373d9117118fef68565c1a5e7eb57ddb53c2656277f2957277e
SSDEEP 6144:ax9Xwhm7c/n10V7cMW4Es+CS/wUcvzUjSa5pK2mKdl0TruunfD09gfJChgGJhCj:abXwhm7a1gB4/8vYjDpK8atfx8hDu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

kutaki

http://newbosslink.xyz/baba/new4.php

Targets

- Target
  Payment Confirmation Invoice.exe
- Size 408KB
- SHA256 29b194f5409b24a2bdf4b74f35e13a73e7e133dab36339f7b2cc9a0e4f007e17
- MD5 226bea0278f6534c83992d1ceac1c211
- SHA1 b1a3df7bedbb45b0a2df9e575293d795996da01a
- SHA512 e889315f6609ace41811e0f7379cccb802b0ed3012337f9653241b3a0bdaf9b9bf523b9134b2e373d9117118fef68565c1a5e7eb57ddb53c2656277f2957277e
- SSDEEP 6144:ax9Xwhm7c/n10V7cMW4Es+CS/wUcvzUjSa5pK2mKdl0TruunfD09gfJChgGJhCj:abXwhm7a1gB4/8vYjDpK8atfx8hDu
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

kutaki keylogger stealer
- Kutaki
  Information stealer and keylogger that hides inside legitimate Visual Basic applications.
  stealer keylogger kutaki
- Kutaki Executable
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Kutaki Executable

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2