kutaki | 2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics[.]exe

General

Target
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe
Size 645KB
Sample240519-yt2ewafd53
SHA256 aa2228845b62429199c3bc15482fece687518c1b55e6d19a4816be2652159296
MD5 2c503f3afa7dc8b3ff80910eaee058b0
SHA1 67d1b22afc35b76b813a25f1a6d0beb5074bab68
SHA512 9fda6580f08dcb171dc10da16d74cd7e5c3cfa138311d0bb680568d00d6c69cd6cf22c2b2e5359eeaf8dc01948eecbf9816275509faf0557c9015fdfcd8658d2
SSDEEP 12288:p700p8Erbi0OpL46A9jmP/uhu/yMS08CkntxYRgL:zp8Erb+GfmP/UDMS08Ckn37
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newlinkwotolove.club/love/three.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe

File Explorer

2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe

.exe 645KB

2c503f3afa7dc8b3ff80910eaee058b0_NeikiAnalytics.exe

IMPHASH fe861f2f4b786aaf098d845a65e3a1cb
SHA256 aa2228845b62429199c3bc15482fece687518c1b55e6d19a4816be2652159296
MD5 2c503f3afa7dc8b3ff80910eaee058b0
SHA1 67d1b22afc35b76b813a25f1a6d0beb5074bab68
SHA512 9fda6580f08dcb171dc10da16d74cd7e5c3cfa138311d0bb680568d00d6c69cd6cf22c2b2e5359eeaf8dc01948eecbf9816275509faf0557c9015fdfcd8658d2
SSDEEP 12288:p700p8Erbi0OpL46A9jmP/uhu/yMS08CkntxYRgL:zp8Erb+GfmP/UDMS08Ckn37
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaStrErrVarCopy __vbaVarIndexLoadRef _adj_fprem1 ord518 ord519 ord626 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct __vbaVarIndexLoadRefLock ord591 __vbaVarForInit ord593 ord594 ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad ord520 __vbaRefVarAry __vbaBoolVarNull __vbaFpR8 _CIsin ord631 __vbaErase __vbaVarCmpGt ord632 __vbaVargVarMove ord525 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord670 __vbaVarOr ord563 __vbaVarLateMemSt ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaStrR8 __vbaR8Cy __vbaRedim EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord607 __vbaLateIdStAd ord714 __vbaVarDiv ord608 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaR8Str ord570 __vbaVar2Vec __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 __vbaDerefAry1 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarLateMemStAd ord689 __vbaFpCy __vbaLateMemCall __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj ord613 __vbaFpI2 __vbaFpI4 __vbaVarLateMemCallLd __vbaVarCopy __vbaVarTstGe ord616 __vbaLateMemCallLd ord617 _CIatan ord618 __vbaAryCopy __vbaCastObj __vbaStrMove __vbaR8IntI4 __vbaStrVarCopy __vbaForEachVar ord619 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing