General

  • Target

    IncomeTax_Challan_Copy.exe

  • Size

    1.7MB

  • Sample

    230130-j5j8eahf93

  • MD5

    9cebc9cd7dec812aa0891df66d2dfd50

  • SHA1

    739286547c4533f85ba1187acb3d46eb13b1090f

  • SHA256

    58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77

  • SHA512

    347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb

  • SSDEEP

    24576:KeqSDLyQvKTLEXIRtJ4tjhXGT743iX8EFuvXb0lPCDB3oy4LJ1/obfmP/UDMS08s:KeqSDdvKHEXIHJEBGvY+kwyfmP/SA8Ne

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Targets

    • Target

      IncomeTax_Challan_Copy.exe

    • Size

      1.7MB

    • MD5

      9cebc9cd7dec812aa0891df66d2dfd50

    • SHA1

      739286547c4533f85ba1187acb3d46eb13b1090f

    • SHA256

      58092b88b330eec0e01a54c5ea8715b2206e8775b56ca54400c5cae59bc23f77

    • SHA512

      347b593128ebdc5f519955d788461f6842795fdd18163baa38bae6cf59a73e423018bd4e8446cb1bae42c75b3da821bd45ec36af6329bb1eedec956b4ef4accb

    • SSDEEP

      24576:KeqSDLyQvKTLEXIRtJ4tjhXGT743iX8EFuvXb0lPCDB3oy4LJ1/obfmP/UDMS08s:KeqSDdvKHEXIHJEBGvY+kwyfmP/SA8Ne

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks