kutaki | Payment Confirmation[.]exe

General

Target
Payment Confirmation.exe
Size 621KB
Sample230113-sdchxsde2t
SHA256 ed8534bd6aa40b9c0af7f68fe82154b3e7f0a82ecb05189a2de9884521f963a5
MD5 7558689ffc3f6a0da8e35d8f257c86bb
SHA1 40b520982a8e9e79c39eec75d3b62d685b8946e5
SHA512 acd8e620abdd36c822245afbe87f27d554a111054ed434b8d03dd11e6ac2fd6ac8613a210b0bc4697738b73b0c6119a3d0d42671d67f1ecdea393beafd6ca401
SSDEEP 12288:/GDq0pDRbx37mEZBVlUvE46A9jmP/uhu/yMS08CkntxYRXL:/GDq05R1rmEZBQfmP/UDMS08Ckn3y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newbosslink.xyz/baba/new4.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

Payment Confirmation.exe

.exe 621KB

Payment Confirmation.exe

IMPHASH dceabeaf492b36987f5367e43448ceda
SHA256 ed8534bd6aa40b9c0af7f68fe82154b3e7f0a82ecb05189a2de9884521f963a5
MD5 7558689ffc3f6a0da8e35d8f257c86bb
SHA1 40b520982a8e9e79c39eec75d3b62d685b8946e5
SHA512 acd8e620abdd36c822245afbe87f27d554a111054ed434b8d03dd11e6ac2fd6ac8613a210b0bc4697738b73b0c6119a3d0d42671d67f1ecdea393beafd6ca401
SSDEEP 12288:/GDq0pDRbx37mEZBVlUvE46A9jmP/uhu/yMS08CkntxYRXL:/GDq05R1rmEZBQfmP/UDMS08Ckn3y
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

14088

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit __vbaExitProc ord594 ord301 __vbaObjSet ord595 __vbaOnError ord596 _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaStrFixstr ord307 ord309 __vbaFpR8 __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 __vbaErase ord709 __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaStrToUnicode ord712 __vbaInputFile __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 __vbaI2Str ord608 __vbaFPException ord717 __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 __vbaR8Str __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaNew2 ord648 __vbaInStr ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord578 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaVarLateMemCallLd ord616 __vbaFpI4 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaAryCopy ord618 __vbaStrMove __vbaForEachVar ord619 __vbaR8IntI4 __vbaStrVarCopy _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd ord546 __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing