kutaki | Payment_Receipt[.]zip

General

Target
Payment_Receipt.zip
Size 422KB
Sample230630-pp8tqabd95
SHA256 03e067b68230dd9da8e74c905e862dd1f7c094a35606405d4e426f8ba02981bc
MD5 c673b09e0527528bbd30c5d03b7af463
SHA1 48e5b652d16a4eddb07ae119638a504ba477a486
SHA512 2b64a045aa3812515c183b07b8b7f171bdde94e79e9cc13cccce0713c836edd8ebef958ed232ddb6d191fa022115df2eb8790b2ff9bc6cc928c5deddcb3b2701
SSDEEP 12288:pokf0ngJ6K36HBx04cA9jmd/uhoVyM+08CknJTYR8:pSK6o6HBtJmd/UZM+08CknpJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newloshree.xyz/work/son.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/Payment_Receipt.exe	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Payment_Receipt.exe

File Explorer

Payment_Receipt.zip

.zip 422KB
Payment_Receipt.exe

.exe 812KB

Payment_Receipt.zip

SHA256 03e067b68230dd9da8e74c905e862dd1f7c094a35606405d4e426f8ba02981bc
MD5 c673b09e0527528bbd30c5d03b7af463
SHA1 48e5b652d16a4eddb07ae119638a504ba477a486
SHA512 2b64a045aa3812515c183b07b8b7f171bdde94e79e9cc13cccce0713c836edd8ebef958ed232ddb6d191fa022115df2eb8790b2ff9bc6cc928c5deddcb3b2701
SSDEEP 12288:pokf0ngJ6K36HBx04cA9jmd/uhoVyM+08CknJTYR8:pSK6o6HBtJmd/UZM+08CknpJ
MD5 SHA1 SHA512 SSDEEP

Payment_Receipt.exe

IMPHASH 92ea9227782f0ce87ec7d6acf15fa241
SHA256 c056c58e3d32716447e27dbe38e784b685203dededddf1253ba4051d0a7a174a
MD5 fad8c7f1f023b519a8bc97f44c845f1b
SHA1 e305349bd0dda9732aaab10499153d6e80ce11bc
SHA512 ff1a302e99ad89f01c805517085fd76291ee594edc0e9e9c3980cd47dbf1c2429016b11df3b7621eb96da914809b2bb47e5291ec3cd2894f43ff116f9ce39fb3
SSDEEP 12288:jw/h2mDPAtjj4cv6aiUoIxbU546A9jmP/uhu/yMS08CkntxYRK:EPmjj4cZfmP/UDMS08Ckn3n
MD5 SHA1 SHA512 SSDEEP

windows x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17232

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaResume __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord552 ord553 ord660 __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB ord662 __vbaHresultCheckObj ord557 __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar __vbaVarTstLe ord667 Zombie_GetTypeInfo __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaLateMemSt ord593 __vbaVarForInit __vbaExitProc __vbaForEachCollObj ord594 __vbaObjSet __vbaOnError ord595 ord596 _adj_fdiv_m16i ord702 __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord599 __vbaForEachCollVar ord520 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaNextEachCollObj __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 ord560 __vbaDateR8 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaCastObjVar __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord606 ord713 __vbaDateStr _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaCheckType __vbaI2Var ord644 ord537 ord645 ord538 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaVar2Vec __vbaInStr __vbaVarLateMemCallLdRf __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaVarSetObj __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt ord575 __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy ord610 __vbaAryLock __vbaVarAdd __vbaLateMemCall __vbaStrComp __vbaFreeVarg ord612 __vbaStrToAnsi __vbaVarDup ord613 __vbaFpI2 __vbaFpI4 ord616 __vbaVarLateMemCallLd __vbaRecDestructAnsi ord617 __vbaLateMemCallLd _CIatan __vbaAryCopy ord618 __vbaStrMove __vbaCastObj __vbaForEachVar __vbaR8IntI4 __vbaStrVarCopy ord619 ord542 ord650 ord543 _allmul ord544 __vbaLateIdSt ord545 _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing