kutaki | be45525f4eb11a6b14a0922bf3fafdd5[.]zip

General

Target
be45525f4eb11a6b14a0922bf3fafdd5.zip
Size 347KB
Sample220919-m99weaebf5
SHA256 6f1a46186597a3c90fd56bae547ef7d486d961c33ca73eb613e4186d8b5a371f
MD5 be45525f4eb11a6b14a0922bf3fafdd5
SHA1 40a6d21cdf4b1f2b33c1ea3d1a986ce457cfe4d7
SHA512 f161188bfd28335ba6d2d966527d9dc025443f062a360b273ec2574744dd2516e2c0c717248a863b567f847a1abfb4936961798b0dd4a1c7479d9d6057ed944e
SSDEEP 6144:Kycd5z05U2cyGS3FvmGRJ5KVZ4Es+CSfwOCvzMjSa7pKu6sdl0T7u+ntD0pgfNCz:KlddaU2cyGI+Gn0VK4fyvojJpKYazt/E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/ITC.exe	family_kutaki

Kutaki family
kutaki

File Explorer

be45525f4eb11a6b14a0922bf3fafdd5.zip

.zip 347KB
ITC.exe

.exe 544KB

be45525f4eb11a6b14a0922bf3fafdd5.zip

SHA256 6f1a46186597a3c90fd56bae547ef7d486d961c33ca73eb613e4186d8b5a371f
MD5 be45525f4eb11a6b14a0922bf3fafdd5
SHA1 40a6d21cdf4b1f2b33c1ea3d1a986ce457cfe4d7
SHA512 f161188bfd28335ba6d2d966527d9dc025443f062a360b273ec2574744dd2516e2c0c717248a863b567f847a1abfb4936961798b0dd4a1c7479d9d6057ed944e
SSDEEP 6144:Kycd5z05U2cyGS3FvmGRJ5KVZ4Es+CSfwOCvzMjSa7pKu6sdl0T7u+ntD0pgfNCz:KlddaU2cyGI+Gn0VK4fyvojJpKYazt/E
MD5 SHA1 SHA512 SSDEEP

ITC.exe

IMPHASH 439780d0dfcc861d7dbb1b4ab2147bb4
SHA256 83d66249977c93aee45be9aa3e6ccfc2b450c23bc9db6e8e0764ed35e1b5a06e
MD5 039f072565f5c1a20edbddc6a8cd4b7e
SHA1 0b0577a885f82fd073dc1f86e5ee6e72054030e1
SHA512 74a08454326688fc944d05ec9d37ee21aa1de2bd5ab5d03c7360bf0245650a083bb8e77fba876475513750154809c437db0fd92b18386fcca98cc3d82cf907fd
SSDEEP 6144:m8ylUOltoMFD95ad/gvlfZPFHrbl3wL0n9/G0GM5JLMKRMWBXd+tPdv5W4Es+CSE:p2YcJmW/+b5B4/8vYjDpK8atfx8hDu
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

15036

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaRecAnsiToUni ord626 ord519 __vbaResume __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaSetSystemError __vbaRecDestruct __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar __vbaVarTstLe ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 __vbaExitProc ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaFpR8 __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 __vbaErase ord709 __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord713 ord606 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 ord531 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaNew2 __vbaInStr __vbaR8Str _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj __vbaStrCopy ord573 __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaVarDup __vbaStrToAnsi __vbaVarLateMemCallLd ord616 __vbaVarCopy __vbaFpI4 __vbaLateMemCallLd ord617 __vbaRecDestructAnsi _CIatan __vbaCastObj __vbaAryCopy ord618 __vbaStrMove __vbaForEachVar __vbaR8IntI4 ord619 __vbaStrVarCopy ord650 _allmul _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing