Overview

overview

10

Static

static

10

682572888b...73.exe

windows7-x64

10

682572888b...73.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73

  • Size

    465KB

  • Sample

    240511-24cq2sgb48

  • MD5

    ae6e96376af9418752b9c2c9e9e1debf

  • SHA1

    bbb067145926697c07e80a0308106112b1189039

  • SHA256

    682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73

  • SHA512

    4164d0c607636d6ba462d9556c7841cb77131e693c6a0af15cb062222052e099bfcc44f941f9fd5f1e19f585ca9b85d2e4f25b994f2b1415deb48782d64971b7

  • SSDEEP

    12288:IVl4yCL6f6f0xB81IWa46A9jmP/uhu/yMS08CkntxYRYL:a7k3fmP/UDMS08Ckn3X

Score
10/10
kutakikeyloggerstealer

Malware Config

Extracted

Family

kutaki

C2

http://newlinkwotolove.club/love/three.php

Targets

    • Target

      682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73

    • Size

      465KB

    • MD5

      ae6e96376af9418752b9c2c9e9e1debf

    • SHA1

      bbb067145926697c07e80a0308106112b1189039

    • SHA256

      682572888b60da06809d5f5dbce53b9a1bfede2d7a2deae9039e3020d68b1a73

    • SHA512

      4164d0c607636d6ba462d9556c7841cb77131e693c6a0af15cb062222052e099bfcc44f941f9fd5f1e19f585ca9b85d2e4f25b994f2b1415deb48782d64971b7

    • SSDEEP

      12288:IVl4yCL6f6f0xB81IWa46A9jmP/uhu/yMS08CkntxYRYL:a7k3fmP/UDMS08Ckn3X

    Score
    10/10
    kutakikeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks