Resubmissions

08-08-2023 17:00

230808-vjbjxsfg5y 10

08-08-2023 13:18

230808-qkbh4acf95 10

General

  • Target

    Income-Tax.exe

  • Size

    529KB

  • Sample

    230808-qkbh4acf95

  • MD5

    8a182209d4a6fea9223298590e59bd7e

  • SHA1

    909b60f35926c3173d36ce80127fb7792ef86402

  • SHA256

    ec5a7e9539938fcb1c2feadf59afa9e864144e52aeb6a4715cc50f188c72c053

  • SHA512

    425d15a1e9c9967514edaad9357182fe0ef5b392d072cf300bdf02e9927687adbc00c45b7345aae481e38dbbf4a4a3152756cb89e99a93f252c7cc740746ed38

  • SSDEEP

    12288:TOJHqVR3f53gG46A9jmP/uhu/yMS08CkntxYR7L:68VRvWRfmP/UDMS08Ckn32

Malware Config

Extracted

Family

kutaki

C2

http://waaatlink.xyz/hello/son.php

Targets

    • Target

      Income-Tax.exe

    • Size

      529KB

    • MD5

      8a182209d4a6fea9223298590e59bd7e

    • SHA1

      909b60f35926c3173d36ce80127fb7792ef86402

    • SHA256

      ec5a7e9539938fcb1c2feadf59afa9e864144e52aeb6a4715cc50f188c72c053

    • SHA512

      425d15a1e9c9967514edaad9357182fe0ef5b392d072cf300bdf02e9927687adbc00c45b7345aae481e38dbbf4a4a3152756cb89e99a93f252c7cc740746ed38

    • SSDEEP

      12288:TOJHqVR3f53gG46A9jmP/uhu/yMS08CkntxYR7L:68VRvWRfmP/UDMS08Ckn32

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks