kutaki | 9845b8d011afd9d1b2557e3f93c2e031[.]bin

General

Target
9845b8d011afd9d1b2557e3f93c2e031.bin
Size 353KB
Sample240209-dntgvsgf94
SHA256 f38a290cfaf3d4de3e6251336daadf14f45515c97c8f09ce83c19aa6d5e37b8f
MD5 1404182cb8a253461dedcceb490af3cb
SHA1 c7525ba615f29f1d7acf63f9dba810c68f8b90bd
SHA512 101fe81ad89d73363fb2b2e98b8db573049bd83a20c910c0a28f07d8e2b4e1300c38a80ed6933e95cc58d49025d8f0a42fe967b063456b7bcf700b85f0266250
SSDEEP 6144:ricnJoyZObNx/7MnWPXi8RlC92/qef6CYjpaCRrEDqpGP6nWQ8R/LOrfQ:WcJFeNx/7eWdU9AfsphpgUWL/LOrY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php
http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d1434a4d08341f78a58b3dbf922831cc4dc1cff634acd7385ed81bba15d848df.exe

File Explorer

9845b8d011afd9d1b2557e3f93c2e031.bin

.zip 353KB
d1434a4d08341f78a58b3dbf922831cc4dc1cff634acd7385ed81bba15d848df.exe

.exe 536KB

9845b8d011afd9d1b2557e3f93c2e031.bin

SHA256 f38a290cfaf3d4de3e6251336daadf14f45515c97c8f09ce83c19aa6d5e37b8f
MD5 1404182cb8a253461dedcceb490af3cb
SHA1 c7525ba615f29f1d7acf63f9dba810c68f8b90bd
SHA512 101fe81ad89d73363fb2b2e98b8db573049bd83a20c910c0a28f07d8e2b4e1300c38a80ed6933e95cc58d49025d8f0a42fe967b063456b7bcf700b85f0266250
SSDEEP 6144:ricnJoyZObNx/7MnWPXi8RlC92/qef6CYjpaCRrEDqpGP6nWQ8R/LOrfQ:WcJFeNx/7eWdU9AfsphpgUWL/LOrY
MD5 SHA1 SHA512 SSDEEP

Password

infected

d1434a4d08341f78a58b3dbf922831cc4dc1cff634acd7385ed81bba15d848df.exe

IMPHASH 70e6405c911e37e751e66490fe6b9801
SHA256 d1434a4d08341f78a58b3dbf922831cc4dc1cff634acd7385ed81bba15d848df
MD5 9845b8d011afd9d1b2557e3f93c2e031
SHA1 c0ac7f5b94a90437f846a1075aab8b6de5e4aca9
SHA512 4d83b5ee7d4e2d08b6041f14bd532c39191913d4d9c8e0e488ffaf9ec8d2acd8ccf4fde19a6a110f8b9aa645ce8d96d0e8debb849df4cc36fce2fae04968d116
SSDEEP 12288:KcUplyaw22FrGA46A9jmP/uhu/yMS08CkntxYR:KBplyaw2VzfmP/UDMS08Ckn3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

13384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLateIdCall __vbaLenBstr ord696 __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit ord594 ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar __vbaObjVar __vbaI2I4 ord561 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec ord570 ord648 __vbaNew2 __vbaR8Str __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq ord689 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj ord618 __vbaAryCopy __vbaStrMove __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing