kutaki | Tax_Payment_Receipt[.]exe

General

Target
Tax_Payment_Receipt.exe
Size 1.0MB
Sample230207-wwfj3sdb24
SHA256 600ed7173b9c1cc4a9d5c058d7079d742854b5a2a010403ca4e36aa5e8b457d8
MD5 48b4adffdbe0a5e704653fd7a6cf5a3e
SHA1 ab735248496ead4be59f20eedc4e983b2edb8912
SHA512 1aeb8ffa266e6bba51793c7ed5c5c7f68bfa7ac647c1f5d1a1decb03802cb1d675d23c19491d9e759bc7a0decfc081ed07bdf43f85894357a41da6f7c7a91ff8
SSDEEP 24576:AvPS/SnugUM+4Zt5lWfmP/UDMS08Ckn3Y0:AvPEwug1cfmP/SA8No0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

File Explorer

Tax_Payment_Receipt.exe

.exe 1.0MB

Tax_Payment_Receipt.exe

IMPHASH d05f235ab4361da42178be81d9f5db86
SHA256 600ed7173b9c1cc4a9d5c058d7079d742854b5a2a010403ca4e36aa5e8b457d8
MD5 48b4adffdbe0a5e704653fd7a6cf5a3e
SHA1 ab735248496ead4be59f20eedc4e983b2edb8912
SHA512 1aeb8ffa266e6bba51793c7ed5c5c7f68bfa7ac647c1f5d1a1decb03802cb1d675d23c19491d9e759bc7a0decfc081ed07bdf43f85894357a41da6f7c7a91ff8
SSDEEP 24576:AvPS/SnugUM+4Zt5lWfmP/UDMS08Ckn3Y0:AvPEwug1cfmP/SA8No0
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable

Minor OS version

Major OS version

Entry point

16332

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 ord698 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 Zombie_GetTypeInfo __vbaAryDestruct __vbaLateMemSt ord591 __vbaVarIndexLoadRefLock __vbaVarForInit ord593 __vbaExitProc ord300 ord594 __vbaOnError ord595 __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord306 __vbaForEachCollVar __vbaBoolVar ord520 __vbaFpR8 __vbaBoolVarNull __vbaRefVarAry _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq ord560 __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaI2I4 __vbaObjVar DllFunctionCall ord563 __vbaVarOr ord670 __vbaVarLateMemSt ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaR8Cy __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaLateIdCallSt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord606 ord713 __vbaDateStr _adj_fprem _adj_fdivr_m64 ord714 ord607 __vbaLateIdStAd ord608 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaVar2Vec __vbaInStr __vbaR8Str __vbaVarLateMemCallLdRf __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq ord689 __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrToAnsi __vbaStrComp __vbaVarDup ord612 __vbaVerifyVarObj __vbaFpI4 ord616 __vbaVarCopy __vbaVarLateMemCallLd __vbaLateMemCallLd ord617 _CIatan __vbaAryCopy ord618 __vbaCastObj __vbaStrMove __vbaForEachVar ord619 __vbaR8IntI4 __vbaStrVarCopy _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd ord546 __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing