kutaki | IncomeTax_Payment_Acknowledgement[.]zip

General

Target
IncomeTax_Payment_Acknowledgement.zip
Size 1.1MB
Sample220913-dc2n4aeee8
SHA256 efe869dde8d4abbf6d697566cf13ff253a8fd3066cf81e536bad37f05a8ba788
MD5 0f6fb2c6d9938ac05cd057a34086de8c
SHA1 25704ad023514169806d38b440c3e5e9e7fdc24a
SHA512 fd4ce3e0ee215d46887fad726d9474fb9d8195d1edc4d4b3148a132cbc06cf41ec344417d414eb624e9e0c1ff9e17cb3b45d67e713287aad66759fb7cf4fa0c1
SSDEEP 24576:Q3iAUK4BCApDNVxZ+4O9KCGxJoRhCRxQM1GbK2bKVmv/UhM208CknNb:QXUKyCap+b907REpmVmv/8W8NR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/IncomeTax_Payment_Acknowledgement.exe	family_kutaki

Kutaki family
kutaki

File Explorer

IncomeTax_Payment_Acknowledgement.zip

.zip 1.1MB
IncomeTax_Payment_Acknowledgement.exe

.exe 2.4MB

IncomeTax_Payment_Acknowledgement.zip

SHA256 efe869dde8d4abbf6d697566cf13ff253a8fd3066cf81e536bad37f05a8ba788
MD5 0f6fb2c6d9938ac05cd057a34086de8c
SHA1 25704ad023514169806d38b440c3e5e9e7fdc24a
SHA512 fd4ce3e0ee215d46887fad726d9474fb9d8195d1edc4d4b3148a132cbc06cf41ec344417d414eb624e9e0c1ff9e17cb3b45d67e713287aad66759fb7cf4fa0c1
SSDEEP 24576:Q3iAUK4BCApDNVxZ+4O9KCGxJoRhCRxQM1GbK2bKVmv/UhM208CknNb:QXUKyCap+b907REpmVmv/8W8NR
MD5 SHA1 SHA512 SSDEEP

IncomeTax_Payment_Acknowledgement.exe

IMPHASH 07a28b3453808218de239fc017861c63
SHA256 a19a7785b190a62882c5e1101de45d380ff7b61db8a7d76bbf07ab6d9a94d294
MD5 643a9bfe03a5ab7ce2afe23e6edf7950
SHA1 054e41125bf975932f88573cdbaac302a8ca3932
SHA512 4361308a7316b95fbbb90a51aa62550910624bef3b2aaec8b6d48bd081db1c51cca8e88710fc068b028e019dce1c81c066654462f856b803825ca32eb58db3bd
SSDEEP 24576:U6fWaOBKmi1nPWohnrGhRoqgnfmP/UDMS08Ckn3:ZGKmiFrSwfmP/SA8N
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

17820

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 __vbaRecAnsiToUni ord518 ord519 ord626 __vbaVarCmpNe __vbaForEachCollAd __vbaStrCat ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar __vbaVarTstLe ord667 Zombie_GetTypeInfo __vbaAryDestruct __vbaVarIndexLoadRefLock ord591 ord593 __vbaForEachCollObj __vbaVarForInit __vbaExitProc ord300 ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad ord599 ord306 __vbaForEachCollVar ord520 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVargVarMove ord525 __vbaNextEachCollObj __vbaVarCmpGt ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaI2I4 __vbaObjVar DllFunctionCall ord670 __vbaVarLateMemSt __vbaVarOr ord563 ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaR4Var __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaR8Cy __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 __vbaStrToUnicode __vbaPrintFile ord712 ord606 ord713 _adj_fprem _adj_fdivr_m64 ord607 ord714 __vbaVarDiv ord608 ord531 __vbaFPException ord717 __vbaInStrVar ord319 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec ord648 ord570 __vbaInStr __vbaR8Str __vbaNew2 __vbaVarLateMemCallLdRf _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaLateMemCall ord320 __vbaStrComp __vbaStrToAnsi __vbaVarDup ord321 __vbaFpI4 ord616 __vbaVarCopy __vbaVarLateMemCallLd __vbaRecDestructAnsi ord617 __vbaLateMemCallLd _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaCastObj ord619 __vbaR8IntI4 __vbaStrVarCopy __vbaForEachVar ord650 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing