kutaki | Invoice No 3031[.]zip

General

Target
Invoice No 3031.zip
Size 610KB
Sample230419-epaltagb72
SHA256 7be7c55b508491fc120da9f6e3390bd35f97c234088a1d512bc0209fe700cff2
MD5 a2085e75897e90b690272839e0780a2d
SHA1 f70f7dc4f0c41b30845a259eeeb88dc5a885566c
SHA512 7ba742697f1696a88d27e5870a0821817b35c5d35f2c4ae44d543753f07b51ae99673e39a60e901adb274ddcc7af119c60277f0676914d11c6c40cb3fd0c40e9
SSDEEP 12288:3n04QA9/mR/U7uLgkS0sCkt/FYRWXgIG9ABWt6EKegZfi9oAr:3tmR/+DkS0sCktN2feBpEKeSi1r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php
http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki family
kutaki

File Explorer

Invoice No 3031.zip

.zip 610KB
Invoice No 3031.cmd

.exe 392KB
Invoice No 3031.zip

.zip 305KB
Invoice No 3031.cmd

.exe 392KB

Invoice No 3031.zip

SHA256 7be7c55b508491fc120da9f6e3390bd35f97c234088a1d512bc0209fe700cff2
MD5 a2085e75897e90b690272839e0780a2d
SHA1 f70f7dc4f0c41b30845a259eeeb88dc5a885566c
SHA512 7ba742697f1696a88d27e5870a0821817b35c5d35f2c4ae44d543753f07b51ae99673e39a60e901adb274ddcc7af119c60277f0676914d11c6c40cb3fd0c40e9
SSDEEP 12288:3n04QA9/mR/U7uLgkS0sCkt/FYRWXgIG9ABWt6EKegZfi9oAr:3tmR/+DkS0sCktN2feBpEKeSi1r
MD5 SHA1 SHA512 SSDEEP

Password

infected

Invoice No 3031.cmd

IMPHASH e715f3c5058fd2de28211e01a1b3ec74
SHA256 30dfdf5dc70837a7d9a22bb1128100ba462ef69d3cf97eaa65e7104dd19ce6d7
MD5 834d27a3338f27c774f1ac360bd811a2
SHA1 8b7c89a775b2cbe13b254ca062eea65f7c2ac6d6
SHA512 64b75de52045819d4579c3fc35dd8364669f3564ae3aea63a939bf38f6f85636fe3b9aa719969989b9f4f1d91e1366b329ddd270aae60e5b3f091de46bd09c08
SSDEEP 6144:NioDjSNztkmcu1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYR:wK46A9jmP/uhu/yMS08CkntxYR
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

4684

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Invoice No 3031.cmd

IMPHASH e715f3c5058fd2de28211e01a1b3ec74
SHA256 30dfdf5dc70837a7d9a22bb1128100ba462ef69d3cf97eaa65e7104dd19ce6d7
MD5 834d27a3338f27c774f1ac360bd811a2
SHA1 8b7c89a775b2cbe13b254ca062eea65f7c2ac6d6
SHA512 64b75de52045819d4579c3fc35dd8364669f3564ae3aea63a939bf38f6f85636fe3b9aa719969989b9f4f1d91e1366b329ddd270aae60e5b3f091de46bd09c08
SSDEEP 6144:NioDjSNztkmcu1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYR:wK46A9jmP/uhu/yMS08CkntxYR
MD5 SHA1 SHA512 SSDEEP

windows x86

Password

infected

Minor OS version

Major OS version

Entry point

4684

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Invoice No 3031.zip

Invoice No 3031.cmd

msvbvm60

Invoice No 3031.zip

Invoice No 3031.cmd

msvbvm60

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Invoice No 3031.zip

Invoice No 3031.cmd

msvbvm60

Invoice No 3031.zip

Invoice No 3031.cmd

msvbvm60