kutaki | 541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b

General

Target
541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b
Size 754KB
Sample240524-smpjvaae89
SHA256 541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b
MD5 cc3dea0182a77c7ca10925e2c180bc62
SHA1 537cd49fa4abf265b69d9d0de982373544c643fc
SHA512 99655f1a80a9aacb5f77917700f4303a53368e62d7807196b6e5fa917a40382523ea9ab42a81ba66d7c2bab12ff291bd2efc0399922ae578f8332e982fda40e0
SSDEEP 12288:K39b2oWvRykNICNEZjwJxtk46A9jmP/uhu/yMS08CkntxYRcBAL:KeNIuEZjqxVfmP/UDMS08Ckn3A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newlinkwotolove.club/love/three.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b

File Explorer

541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b

.exe 754KB

541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b

IMPHASH 55a8f44deac29a6958dcdca0964a7a15
SHA256 541ce09cec54e8df1f14a5e25064929e3f3c151f0d68dd6968d229668443444b
MD5 cc3dea0182a77c7ca10925e2c180bc62
SHA1 537cd49fa4abf265b69d9d0de982373544c643fc
SHA512 99655f1a80a9aacb5f77917700f4303a53368e62d7807196b6e5fa917a40382523ea9ab42a81ba66d7c2bab12ff291bd2efc0399922ae578f8332e982fda40e0
SSDEEP 12288:K39b2oWvRykNICNEZjwJxtk46A9jmP/uhu/yMS08CkntxYRcBAL:KeNIuEZjqxVfmP/UDMS08Ckn3A
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLateIdCall __vbaLenBstr __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaRaiseEvent __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaRecAnsiToUni ord519 ord626 __vbaI4Sgn __vbaVarCmpNe __vbaForEachCollAd __vbaStrCat ord660 __vbaStrDate __vbaSetSystemError __vbaRecDestruct __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaVarTstLe __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaLateMemSt ord593 __vbaVarForInit __vbaExitProc ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord703 __vbaVarIndexLoad ord520 __vbaVarTstLt __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin __vbaErase ord631 __vbaVargVarMove ord525 __vbaVarCmpGt ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaAryConstruct2 __vbaPutOwner3 __vbaVarTstEq __vbaPutOwner4 __vbaObjVar __vbaPrintObj __vbaI2I4 DllFunctionCall ord670 ord563 __vbaVarOr __vbaVarLateMemSt ord564 __vbaFpUI1 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaStrR8 __vbaRedim __vbaR8Cy __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaLateIdCallSt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaStrUI1 __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord713 ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaLateIdStAd ord714 ord608 ord531 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec ord648 __vbaR8Str ord570 __vbaVarLateMemCallLdRf __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaVarCmpEq __vbaFpCy ord610 __vbaLateMemCall __vbaVarAdd __vbaAryLock __vbaStrComp __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj __vbaFpI2 __vbaFpI4 __vbaVarLateMemCallLd __vbaVarCopy ord616 ord617 __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan ord540 __vbaAryCopy ord618 __vbaI2ErrVar __vbaStrMove __vbaCastObj __vbaStrVarCopy __vbaR8IntI4 ord619 __vbaForEachVar _allmul __vbaLateIdSt _CItan ord546 __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaI4ErrVar __vbaFreeStr __vbaFreeObj ord581

Sharing