General

  • Target

    mal.exe

  • Size

    465KB

  • Sample

    221201-kyc17agb8y

  • MD5

    c41cca4d15c20ffe8b9648ec9e9c7a95

  • SHA1

    2d0ee06b8ad28ad4ee2fdea76eb87967ba98620a

  • SHA256

    41ec67a912e7de3898baf0f58013481661ce654144e9334aae2d3baf0f4fecce

  • SHA512

    bbedcf190672e5b24c11ba3482256fe85f5ac890125cf5a4bc457f0e5508336666686c57dd8c67ee4be6606327b4613dddf549eed8252fa81b22401dc49a62b5

  • SSDEEP

    12288:N8ZCw3cuE046A9jmP/uhu/yMS08CkntxYRsL:N8ZCwXEnfmP/UDMS08Ckn37

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Targets

    • Target

      mal.exe

    • Size

      465KB

    • MD5

      c41cca4d15c20ffe8b9648ec9e9c7a95

    • SHA1

      2d0ee06b8ad28ad4ee2fdea76eb87967ba98620a

    • SHA256

      41ec67a912e7de3898baf0f58013481661ce654144e9334aae2d3baf0f4fecce

    • SHA512

      bbedcf190672e5b24c11ba3482256fe85f5ac890125cf5a4bc457f0e5508336666686c57dd8c67ee4be6606327b4613dddf549eed8252fa81b22401dc49a62b5

    • SSDEEP

      12288:N8ZCw3cuE046A9jmP/uhu/yMS08CkntxYRsL:N8ZCwXEnfmP/UDMS08Ckn37

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks