800999621ec6036d4ca4070733a1a76a.zip
- SHA256 4e95c654625af3c239740b6d8f1799d5ad938bcb9404d2935c5240c22985d76b
Behavioral task
behavioral1
Sample
Payment Channel.exe
Resource
win7-20231020-en
windows7-x64
9 signatures
150 seconds
General
- Target 800999621ec6036d4ca4070733a1a76a.zip
- Size 336KB
- Sample231109-k8fvtsaa35
- SHA256 4e95c654625af3c239740b6d8f1799d5ad938bcb9404d2935c5240c22985d76b
- MD5 800999621ec6036d4ca4070733a1a76a
- SHA1 53ee4f63acd929f3a74f91367535015643f2fab9
- SHA512 3e6509d958f07bf925655996674441c33deb9b92c367b9fbd33f8e942a2b674104eacb8f4ce9df5e34c8cafa83e9366d65ef73021a15a4c8f291e6e71f207a58
- SSDEEP 6144:AtqN2xpd9yDiR2Z1+4GpA9jQHL/VCSS3hwVlMbk2u5QMSIy+lqkHTonerW/lYRN:Atjpd9h2y48A9jQr/Uh8peMSI8EknPd8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
kutaki
C2
-
http://linkwotowoto.club/new/two.php
Signatures
- Kutaki Executable 1 IoCs
resource yara_rule static1/unpack001/Payment Channel.exe family_kutaki - Kutaki family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Payment Channel.exe
File Explorer
-
800999621ec6036d4ca4070733a1a76a.zip.zip 336KB
-
Payment Channel.exe.exe 501KB
Payment Channel.exe
- IMPHASH 3910e25da1d2ff6583dec41939e4bd20
- SHA256 b8e4bcb3699104e49979cc86b84ce278bd6b9b392d65d465ac1acd7808ed0db0
- MD5 646849ab728ff631b3c70480638e6a2a
- SHA1 8f9f70ef43add2a45e0a2430b2d9680616faef8b
- SHA512 32f0a0949c33e0b34239581bbb86d3ee42acdaddc9856c78a55b88924dcade166663e2c8345040dbc2f383b74ebda88e952d9091643d8a7ea8e5d1fd82002de3
- SSDEEP 12288:7Ycs+XKy/AZe+e9AP8LP810o4HfyNQlQj0DunOq0Mte9oIopkyd+wMeMIC10pqT1:7Ycs+XKy/AZeJ9AP8LP810o4HfyNQlQM
- MD5 SHA1 SHA512 SSDEEP
-
Kutaki Executable
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13676
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarTstGt
__vbaVarSub
ord690
__vbaStrI2
_CIcos
_adj_fptan
__vbaHresultCheck
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaLateIdCall
__vbaStrVarMove
ord696
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
ord698
__vbaPut4
__vbaNextEachVar
__vbaFreeObjList
ord516
__vbaVarIndexLoadRef
__vbaStrErrVarCopy
_adj_fprem1
ord518
ord626
ord519
__vbaForEachCollAd
__vbaVarCmpNe
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaLenBstrB
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryVar
ord667
__vbaAryDestruct
ord591
__vbaVarIndexLoadRefLock
ord593
__vbaVarForInit
__vbaExitProc
ord594
__vbaI4Abs
ord595
__vbaOnError
__vbaObjSet
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
__vbaForEachCollVar
ord520
__vbaStrFixstr
__vbaBoolVarNull
__vbaRefVarAry
__vbaFpR8
_CIsin
ord631
__vbaErase
__vbaVarCmpGt
__vbaVargVarMove
ord525
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaGet3
ord529
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaGet4
__vbaPutOwner4
__vbaNextEachCollVar
ord561
__vbaObjVar
__vbaI2I4
DllFunctionCall
ord563
__vbaVarOr
ord670
ord564
__vbaLbound
_adj_fpatan
ord568
__vbaLateIdCallLd
__vbaR8Cy
__vbaStrR8
__vbaRedim
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStr2Vec
__vbaUI1I4
__vbaStrUI1
__vbaExceptHandler
ord711
__vbaPrintFile
ord712
__vbaStrToUnicode
ord713
_adj_fprem
_adj_fdivr_m64
ord714
ord607
ord608
__vbaFPException
__vbaInStrVar
ord717
__vbaUbound
__vbaStrVarVal
ord534
__vbaGetOwner4
__vbaVarCat
__vbaI2Var
__vbaLsetFixstrFree
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord570
ord648
__vbaR8Str
__vbaVarLateMemCallLdRf
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarCmpLt
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
ord689
__vbaFpCy
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaStrComp
__vbaVarDup
__vbaFpI2
__vbaVarLateMemCallLd
ord616
__vbaFpI4
__vbaLateMemCallLd
ord617
_CIatan
__vbaCastObj
__vbaAryCopy
ord618
__vbaStrMove
__vbaForEachVar
__vbaR8IntI4
__vbaStrVarCopy
ord619
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaUI1Var
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581
Name
.text
Size
228KB
Virtual Size
227KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
264KB
Virtual Size
261KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=22, id=9, version=8041,
count=1, id=13, version=8169,