Extracted

• • Target

    2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca

  • Size

    561KB

  • MD5

    ae3ecc20ed5eb6d09ac71eed21cadc7b

  • SHA1

    8a5c57538ab356dcf99a320fc3724e618411a7b7

  • SHA256

    2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca

  • SHA512

    a91b222f4890cc53f159390bc5ff725d525a6fb64e9a58842b35ecd0b17a2b989593cea9d16b83473c9fccb3af072296ef0a99499843ca372257ab8fc9e110f1

  • SSDEEP

    12288:dUJ+IF3iIj6bn46A9jmP/uhu/yMS08CkntxYRCL:m+HIe8fmP/UDMS08Ckn3x

  Score

  10^/10

  kutakidiscoverykeyloggerstealer

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

    stealerkeyloggerkutaki

  • Kutaki Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2