kutaki | fd521a6a9e13b00329723103b9039e23950450f901da8f61cea3b92ff96dceee[.]zip

General

Target
fd521a6a9e13b00329723103b9039e23950450f901da8f61cea3b92ff96dceee.zip
Size 336KB
Sample231109-ysa7asee28
SHA256 fd521a6a9e13b00329723103b9039e23950450f901da8f61cea3b92ff96dceee
MD5 97a4007da195e9a00bd0e105813f1564
SHA1 1c5c17b72f8aa10a3597b2259db86ae8a1506d98
SHA512 7bb3905372fd5d7c76ab43460b1f68b029f793227f92bb5e1a09888c45a16cb30f280a5bb59b20a31d12711481e93f86c7b51bc20a3adbed6b72a18c4acd25bf
SSDEEP 6144:ATRHhN+dhgsBVOJXd1+4GpA9jQHL/VCSS3hwVlMbk2u5QMSIy+lqkHTonerW/lY0:A9KDBSXG48A9jQr/Uh8peMSI8EknPdY0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://linkwotowoto.club/new/two.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
static1/unpack001/Challan.exe	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Challan.exe

File Explorer

fd521a6a9e13b00329723103b9039e23950450f901da8f61cea3b92ff96dceee.zip

.zip 336KB
Challan.exe

.exe 501KB

fd521a6a9e13b00329723103b9039e23950450f901da8f61cea3b92ff96dceee.zip

SHA256 fd521a6a9e13b00329723103b9039e23950450f901da8f61cea3b92ff96dceee
MD5 97a4007da195e9a00bd0e105813f1564
SHA1 1c5c17b72f8aa10a3597b2259db86ae8a1506d98
SHA512 7bb3905372fd5d7c76ab43460b1f68b029f793227f92bb5e1a09888c45a16cb30f280a5bb59b20a31d12711481e93f86c7b51bc20a3adbed6b72a18c4acd25bf
SSDEEP 6144:ATRHhN+dhgsBVOJXd1+4GpA9jQHL/VCSS3hwVlMbk2u5QMSIy+lqkHTonerW/lY0:A9KDBSXG48A9jQr/Uh8peMSI8EknPdY0
MD5 SHA1 SHA512 SSDEEP

Challan.exe

IMPHASH 3910e25da1d2ff6583dec41939e4bd20
SHA256 2114e284c9636a3b015aadb156369d5c55dc29541bc9f27ecf3724f16a65fa8d
MD5 816cdd0d2e0852404804a683d1cd1b53
SHA1 9842b46047c8ef18a2041a7a35fe3b51515dd829
SHA512 9648bb75a15afb57baeb7c9becf994dece54f499f04df344210c8241839d493599b71cf7ae7a9f4f790009ba3a9b8d2f80df7db41bac5b78edce20bd1a115cf2
SSDEEP 12288:6Ycs+XKy/AZe+e9AP8LP810o4HfyNQlQj0DunOq0Mte9oIopkyd+wMeMIC10pqTO:6Ycs+XKy/AZeJ9AP8LP810o4HfyNQlQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13676

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaPut4 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaRecDestruct __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit __vbaExitProc ord594 __vbaI4Abs ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaStrFixstr __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin ord631 __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaGet4 __vbaPutOwner4 __vbaNextEachCollVar ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaLbound _adj_fpatan ord568 __vbaLateIdCallLd __vbaR8Cy __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaStrUI1 __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal ord534 __vbaGetOwner4 __vbaVarCat __vbaI2Var __vbaLsetFixstrFree ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 ord648 __vbaR8Str __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy ord681 __vbaI4Str __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaFpCy __vbaVarAdd __vbaAryLock __vbaStrToAnsi __vbaStrComp __vbaVarDup __vbaFpI2 __vbaVarLateMemCallLd ord616 __vbaFpI4 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaAryCopy ord618 __vbaStrMove __vbaForEachVar __vbaR8IntI4 __vbaStrVarCopy ord619 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing