kutaki | 26dd613fb23b6d3a074f487d7566061be28fb4a177d316f950b282e8c3676d9a

General

Target
26dd613fb23b6d3a074f487d7566061be28fb4a177d316f950b282e8c3676d9a
Size 1000KB
Sample221130-tmv73aeg27
SHA256 26dd613fb23b6d3a074f487d7566061be28fb4a177d316f950b282e8c3676d9a
MD5 be1e117af754d19e5ee30b440d9035ec
SHA1 fba8c8bdc482955012103c604b7614f788fb523b
SHA512 18ed6b241bf5589fcb9554db7b12585285856243f2e4bba13e502607bdd1f8ad6fc8a4bdd866d755db76dfd23a9459ca69a419ce922081d22b49d75c8a50c05d
SSDEEP 12288:BIu9pb7QlUDrNMc3946A9jmP/uhu/yMS08CkntxYR0:auDbaurNt2fmP/UDMS08Ckn3J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://sdaskmda.club/papa/love.php
http://terebinnahi.club/sec/kool.txt

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

26dd613fb23b6d3a074f487d7566061be28fb4a177d316f950b282e8c3676d9a

.exe 1000KB

26dd613fb23b6d3a074f487d7566061be28fb4a177d316f950b282e8c3676d9a

IMPHASH 4db5ed98323fd1367827e824593faf95
SHA256 26dd613fb23b6d3a074f487d7566061be28fb4a177d316f950b282e8c3676d9a
MD5 be1e117af754d19e5ee30b440d9035ec
SHA1 fba8c8bdc482955012103c604b7614f788fb523b
SHA512 18ed6b241bf5589fcb9554db7b12585285856243f2e4bba13e502607bdd1f8ad6fc8a4bdd866d755db76dfd23a9459ca69a419ce922081d22b49d75c8a50c05d
SSDEEP 12288:BIu9pb7QlUDrNMc3946A9jmP/uhu/yMS08CkntxYR0:auDbaurNt2fmP/UDMS08Ckn3J
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

15484

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord582 ord690 ord583 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaLenBstr __vbaStrVarMove ord588 ord696 __vbaPut3 __vbaFreeVarList __vbaEnd __vbaVarIdiv _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList __vbaR8Sgn ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaStrCat __vbaVarCmpNe __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar __vbaVargVarCopy _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 __vbaVarPow ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull __vbaVarTstLt _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaVarAbs __vbaGenerateBoundsError ord528 ord529 __vbaGet3 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaLbound _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord607 __vbaVarDiv ord714 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal ord534 __vbaVarCat ord536 __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec ord570 ord648 __vbaR8Str __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList __vbaVarCmpLt ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy __vbaVarAdd __vbaAryLock __vbaStrComp __vbaVarDup __vbaStrToAnsi ord613 __vbaVarMod __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaVarCopy ord617 __vbaLateMemCallLd _CIatan ord618 __vbaAryCopy __vbaStrMove __vbaCastObj __vbaForEachVar __vbaStrVarCopy __vbaR8IntI4 ord619 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaFreeObj __vbaFreeStr ord581

Sharing