Overview

overview

10

Static

static

10

ITC.exe

windows7-x64

10

ITC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be45525f4eb11a6b14a0922bf3fafdd5.zip

  • Size

    347KB

  • Sample

    220919-m99weaebf5

  • MD5

    be45525f4eb11a6b14a0922bf3fafdd5

  • SHA1

    40a6d21cdf4b1f2b33c1ea3d1a986ce457cfe4d7

  • SHA256

    6f1a46186597a3c90fd56bae547ef7d486d961c33ca73eb613e4186d8b5a371f

  • SHA512

    f161188bfd28335ba6d2d966527d9dc025443f062a360b273ec2574744dd2516e2c0c717248a863b567f847a1abfb4936961798b0dd4a1c7479d9d6057ed944e

  • SSDEEP

    6144:Kycd5z05U2cyGS3FvmGRJ5KVZ4Es+CSfwOCvzMjSa7pKu6sdl0T7u+ntD0pgfNCz:KlddaU2cyGI+Gn0VK4fyvojJpKYazt/E

Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Targets

    • Target

      ITC.exe

    • Size

      544KB

    • MD5

      039f072565f5c1a20edbddc6a8cd4b7e

    • SHA1

      0b0577a885f82fd073dc1f86e5ee6e72054030e1

    • SHA256

      83d66249977c93aee45be9aa3e6ccfc2b450c23bc9db6e8e0764ed35e1b5a06e

    • SHA512

      74a08454326688fc944d05ec9d37ee21aa1de2bd5ab5d03c7360bf0245650a083bb8e77fba876475513750154809c437db0fd92b18386fcca98cc3d82cf907fd

    • SSDEEP

      6144:m8ylUOltoMFD95ad/gvlfZPFHrbl3wL0n9/G0GM5JLMKRMWBXd+tPdv5W4Es+CSE:p2YcJmW/+b5B4/8vYjDpK8atfx8hDu

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks