kutaki | ITR-V REFUND[.]zipx

General

Target
ITR-V REFUND.zipx
Size 2.1MB
Sample240108-lwchbagce9
SHA256 22d7b182b1714e4d4c20a0932f9f3164f1ddc48fa93f3678157222421a32f83f
MD5 420ad41d4436eada483ea65d868f2d4b
SHA1 7f5b325f964085a538e33d75e034c7901d6255f7
SHA512 624dac7aaddc31e47a64f4de11f66cf9cbcff2eaf13a1d4d8ab58e1d2952d3fb334265a36c551624e9e85abc2a6e42aa236bd2933b3ea11af7ba48852d09720c
SSDEEP 49152:ccKXqKBgxhgi0Ap6TUybQHD8f9gK1MM4GyOT2HLPZ5cRcPsfm//R68Nt:0aKBgxypAqkHD8OKSM4/Trchfm//R68f
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php
http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/ITR-V REFUND.bat

File Explorer

ITR-V REFUND.zipx

.zip 2.1MB
ITR-V REFUND.iso

.iso 3.0MB
ITR-V REFUND.bat

.exe 2.4MB

ITR-V REFUND.zipx

SHA256 22d7b182b1714e4d4c20a0932f9f3164f1ddc48fa93f3678157222421a32f83f
MD5 420ad41d4436eada483ea65d868f2d4b
SHA1 7f5b325f964085a538e33d75e034c7901d6255f7
SHA512 624dac7aaddc31e47a64f4de11f66cf9cbcff2eaf13a1d4d8ab58e1d2952d3fb334265a36c551624e9e85abc2a6e42aa236bd2933b3ea11af7ba48852d09720c
SSDEEP 49152:ccKXqKBgxhgi0Ap6TUybQHD8f9gK1MM4GyOT2HLPZ5cRcPsfm//R68Nt:0aKBgxypAqkHD8OKSM4/Trchfm//R68f
MD5 SHA1 SHA512 SSDEEP

ITR-V REFUND.bat

IMPHASH 2319dc919418b63a6c12fa5949be8925
SHA256 612ced33c9ed75050dacc0fde4e6e20b6b39ed405fdd71377875484d70723ade
MD5 38a6b50a1bde06601d6bc6f9abdc749b
SHA1 758b7f8cb589d3478da45e1fed970ccc0f8412e8
SHA512 f8abdc0c2106e1fe825e1a9435f9742492d6ca322fbdb43413d6bfbf54a32c7748a0c174e9cc4c52d8d1e20de05d91b8b8734a9fd91bd3169db71d6a035a7971
SSDEEP 49152:oCNkWk5cS7a+9XYaQ2Zehc4mTYJ78V9gyBn4ch6fmP/SA8N:NajJlZ942KQV9hp4pfmP/SA8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaLateIdCall ord696 __vbaEnd __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit ord594 ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaGet3 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaVarDup __vbaStrToAnsi __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj ord618 __vbaAryCopy __vbaStrMove __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing