Extracted

• • Target

    Payment Confirmation.exe

  • Size

    621KB

  • MD5

    7558689ffc3f6a0da8e35d8f257c86bb

  • SHA1

    40b520982a8e9e79c39eec75d3b62d685b8946e5

  • SHA256

    ed8534bd6aa40b9c0af7f68fe82154b3e7f0a82ecb05189a2de9884521f963a5

  • SHA512

    acd8e620abdd36c822245afbe87f27d554a111054ed434b8d03dd11e6ac2fd6ac8613a210b0bc4697738b73b0c6119a3d0d42671d67f1ecdea393beafd6ca401

  • SSDEEP

    12288:/GDq0pDRbx37mEZBVlUvE46A9jmP/uhu/yMS08CkntxYRXL:/GDq05R1rmEZBQfmP/UDMS08Ckn3y

  Score

  10^/10

  kutakikeyloggerstealer

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    stealerkeyloggerkutaki

  • Kutaki Executable

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  behavioral1behavioral2