Overview

overview

10

Static

static

10

NEFT_Payment.exe

windows7-x64

10

NEFT_Payment.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e684f0d39d194075f19ab26d52dee092.zip

  • Size

    2.1MB

  • Sample

    221104-qed22ahdhk

  • MD5

    e684f0d39d194075f19ab26d52dee092

  • SHA1

    5bc3db5f972c7602ba9cd89fbb7d0edffd860b44

  • SHA256

    d0ea011052ff56385e54f47e5f45ae11792a673d22e45ac16661d214b0ed1009

  • SHA512

    c30c4dbf7cb759354b112f9b8d144041c60f2d5f06c8fb10396c690e789c34487b6e36445d3bff2327a0cede01196cd4bbb74674af28863ee355836a39d1a4e6

  • SSDEEP

    49152:kQnI7FlwmUnJR0YdGahOJs+9GvkSLYRj2HYftrybYiYEFC9/Ge8Xm:kYuIRTG4OJs9kSiSYV+bYEFC9/Ge8W

Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Targets

    • Target

      NEFT_Payment.exe

    • Size

      2.3MB

    • MD5

      d61dd474340f39a91ae57cfd1c997fb0

    • SHA1

      22586db543f8770c767ed89c62d7352e80620d8d

    • SHA256

      4ca11aff38d3d7b79a6ee372e8aab8ac38157965f975f8540065bc67bc116824

    • SHA512

      2df78e05dac0142ce18eb78d0c15f0e7ffcc9a26231603f5ddda6de53d9a17dc7fd0bc55bfeb245e791b5c87e22a0b6dea81b9a830373a41ffe2586cd7f19108

    • SSDEEP

      49152:FlkWk5cS7a+9XYaQhZehc4mTYJ78V9gyBn4cMfmP/SA8N:rajJaZ942KQV9hp47fmP/SA8

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks