kutaki | 2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca

General

Target
2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca
Size 561KB
Sample240725-phlqls1epc
SHA256 2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca
MD5 ae3ecc20ed5eb6d09ac71eed21cadc7b
SHA1 8a5c57538ab356dcf99a320fc3724e618411a7b7
SHA512 a91b222f4890cc53f159390bc5ff725d525a6fb64e9a58842b35ecd0b17a2b989593cea9d16b83473c9fccb3af072296ef0a99499843ca372257ab8fc9e110f1
SSDEEP 12288:dUJ+IF3iIj6bn46A9jmP/uhu/yMS08CkntxYRCL:m+HIe8fmP/UDMS08Ckn3x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://newlinkwotolove.club/love/three.php

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca

File Explorer

2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca

.exe 561KB

2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca

IMPHASH 40bdc0c5256e24c4834a85f07f1ad7d2
SHA256 2c87a4f8cd94516457dcb4f4563a558120b9b3f9f4aaef5d12eb383ef6b7d4ca
MD5 ae3ecc20ed5eb6d09ac71eed21cadc7b
SHA1 8a5c57538ab356dcf99a320fc3724e618411a7b7
SHA512 a91b222f4890cc53f159390bc5ff725d525a6fb64e9a58842b35ecd0b17a2b989593cea9d16b83473c9fccb3af072296ef0a99499843ca372257ab8fc9e110f1
SSDEEP 12288:dUJ+IF3iIj6bn46A9jmP/uhu/yMS08CkntxYRCL:m+HIe8fmP/UDMS08Ckn3x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaLateIdCall ord696 __vbaFreeVarList __vbaPut3 __vbaEnd _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord519 ord626 __vbaVarCmpNe __vbaForEachCollAd __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit ord594 __vbaOnError __vbaObjSet ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord520 __vbaRefVarAry __vbaBoolVarNull __vbaFpR8 _CIsin ord631 __vbaErase __vbaVargVarMove ord525 __vbaVarCmpGt ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaGet3 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaI2I4 __vbaObjVar DllFunctionCall ord563 ord670 __vbaVarOr ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaVar2Vec __vbaInStr __vbaNew2 __vbaR8Str ord570 __vbaVarLateMemCallLdRf _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy ord681 __vbaI4Str __vbaVarCmpLt __vbaFreeStrList ord576 __vbaDerefAry1 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaFpCy __vbaVarAdd __vbaAryLock __vbaStrToAnsi __vbaStrComp __vbaVarDup __vbaFpI4 ord616 __vbaVarLateMemCallLd ord617 __vbaLateMemCallLd _CIatan ord618 __vbaCastObj __vbaStrMove __vbaAryCopy __vbaForEachVar ord619 __vbaR8IntI4 __vbaStrVarCopy _allmul _CItan __vbaNextEachCollAd __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing