General

  • Target

    INCOMETAX_RECEIPT.exe

  • Size

    1.0MB

  • Sample

    230207-k3armaaf82

  • MD5

    3983e3e2ea37719a50665ac70316a53d

  • SHA1

    029aaed996072a601fae913597f20c976bc2a452

  • SHA256

    86fc1f2dabb60a5c5a30d63d8508240074809554e0630f1d6bed457e3f02e80a

  • SHA512

    afc55b36136dc5028991adc08d82837476d2d3e5f1976b740445d874ba5bf51fb425e7ff85035e5268d2d270b48d109586086ab202174881d430ffa8a20bc113

  • SSDEEP

    24576:XvPS/SnugUM+4Zt5l1fmP/UDMS08Ckn31E:XvPEwug1jfmP/SA8NlE

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Targets

    • Target

      INCOMETAX_RECEIPT.exe

    • Size

      1.0MB

    • MD5

      3983e3e2ea37719a50665ac70316a53d

    • SHA1

      029aaed996072a601fae913597f20c976bc2a452

    • SHA256

      86fc1f2dabb60a5c5a30d63d8508240074809554e0630f1d6bed457e3f02e80a

    • SHA512

      afc55b36136dc5028991adc08d82837476d2d3e5f1976b740445d874ba5bf51fb425e7ff85035e5268d2d270b48d109586086ab202174881d430ffa8a20bc113

    • SSDEEP

      24576:XvPS/SnugUM+4Zt5l1fmP/UDMS08Ckn31E:XvPEwug1jfmP/SA8NlE

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Kutaki Executable

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix

Tasks