kutaki | jtt[.]exe

General

Target
jtt.exe
Size 541KB
Sample221230-kmeqmsfc56
SHA256 9b3c2853944f7dc6985774f53efcdf30b357f3dce5abd8d6b0f924b033d25911
MD5 86f76a5b4137c86d3eed43cfac187f7e
SHA1 a7a8e3c6cd76b6c4a05f6747c75cdd4587c09725
SHA512 9d36390d5b016ed9a27678dc170c6ab95fe5fa0a4b91ac9abd89b99593fa7259efd6f6a5f86943c1b0bb00357e2404688d3cd6df4490cfe592d2b2401c4c25f3
SSDEEP 12288:+2D18PzBRRHsj1SFKihy46A9jmP/uhu/yMS08CkntxYRRL:ypMj1SHfmP/UDMS08Ckn3I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

jtt.exe

.exe 541KB

jtt.exe

IMPHASH 9c732a96f874e2b20189fc0eb14c9c02
SHA256 9b3c2853944f7dc6985774f53efcdf30b357f3dce5abd8d6b0f924b033d25911
MD5 86f76a5b4137c86d3eed43cfac187f7e
SHA1 a7a8e3c6cd76b6c4a05f6747c75cdd4587c09725
SHA512 9d36390d5b016ed9a27678dc170c6ab95fe5fa0a4b91ac9abd89b99593fa7259efd6f6a5f86943c1b0bb00357e2404688d3cd6df4490cfe592d2b2401c4c25f3
SSDEEP 12288:+2D18PzBRRHsj1SFKihy46A9jmP/uhu/yMS08CkntxYRRL:ypMj1SHfmP/UDMS08Ckn3I
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

13944

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaLateIdCall ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaRecAnsiToUni ord519 ord626 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 __vbaExitProc ord594 __vbaObjSet ord595 __vbaOnError ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaStrFixstr __vbaFpR8 __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVargVarMove ord525 ord632 __vbaVarCmpGt __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 __vbaVarLateMemSt ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaPrintFile __vbaStrToUnicode ord712 ord713 ord606 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 __vbaFPException ord717 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaR8Str __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaVarDup __vbaStrToAnsi ord612 __vbaFpI4 __vbaVarCopy __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd __vbaRecDestructAnsi ord617 _CIatan __vbaAryCopy ord618 __vbaCastObj __vbaStrMove __vbaR8IntI4 __vbaStrVarCopy __vbaForEachVar ord619 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd ord546 __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing