General

  • Target

    a1809e923de6cae635be84aa94afa7b7

  • Size

    2.1MB

  • MD5

    a1809e923de6cae635be84aa94afa7b7

  • SHA1

    5356d43b71caddec298f1c93625d72d57a95d9a5

  • SHA256

    fffabbf5eb28e080d666156800c4d0a7ca5c986559fc5c3cc632155d12801fb4

  • SHA512

    49534a75723741944adcb92db3f4b145cd306cb4c386b4884c47fbdd9ced6446706d73c9e691586077980514b9fd3c67a552b74b39d6ebb17709bb356256bb6c

  • SSDEEP

    49152:Tz47kLqtm5DmVmEZseFnDuy3lf7mhmVC1OAXlEjwIUqoZ9m3/QG8Jz:TzZLHGZFKYl6MVYOAXlE8IFA9m3/QG8Z

Score
10/10

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php

http://terebinnahicc.club/sec/kool.txt

Signatures

  • Kutaki family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • a1809e923de6cae635be84aa94afa7b7
    .zip
  • INF_NEFT_Debit.zip
    .zip
  • INF_NEFT_Debit.bat
    .exe windows:4 windows x86

    561c18361eb724808a2d9ecd5f5cc217


    Headers

    Imports

    Sections