kutaki | Payment_Confirmation[.]zipx

General

Target
Payment_Confirmation.zipx
Size 339KB
Sample240802-jy491axgpg
SHA256 54d1075986147686beb5c24b34607afbfa435f626ba1eaca77289b4439dc2d80
MD5 7d78e20be5f51e0dc6dc8c544ae1f2d7
SHA1 8c1fb8cd1e7f4d168bceea6de89dfb95a1711438
SHA512 19bb52358a50060fccdec8897f21e97c58f1ebd3fc688df3a8db5b5a4488a49d4544914b4295d3a81a44d89575b7f3badc6d2e81b8b54cb710f2bf9234e7f507
SSDEEP 6144:vUPAXOeD6N6OCg1R4G9A9j63x/VCSa3hwHlQ/kwupQLS8y+lqiJToninYtEPla:v/tyd4cA9j6B/shK/uLS88Kkn/Cg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php
http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Payment_Confirmation.cmd

File Explorer

Payment_Confirmation.zipx

.zip 339KB
Payment_Confirmation.zip

.zip 339KB
Payment_Confirmation.cmd

.exe 512KB

Payment_Confirmation.zipx

SHA256 54d1075986147686beb5c24b34607afbfa435f626ba1eaca77289b4439dc2d80
MD5 7d78e20be5f51e0dc6dc8c544ae1f2d7
SHA1 8c1fb8cd1e7f4d168bceea6de89dfb95a1711438
SHA512 19bb52358a50060fccdec8897f21e97c58f1ebd3fc688df3a8db5b5a4488a49d4544914b4295d3a81a44d89575b7f3badc6d2e81b8b54cb710f2bf9234e7f507
SSDEEP 6144:vUPAXOeD6N6OCg1R4G9A9j63x/VCSa3hwHlQ/kwupQLS8y+lqiJToninYtEPla:v/tyd4cA9j6B/shK/uLS88Kkn/Cg
MD5 SHA1 SHA512 SSDEEP

Payment_Confirmation.cmd

IMPHASH 1362e1ebaac681b9db57d981d18d3ae8
SHA256 d900c478a67d9ad11c0f5c6174d9d0326e71f2e91a14c0305f51ac8eb443ea9e
MD5 100408c26c4d52d6b0e3f8d943972bd9
SHA1 064aad1117e6b347763cfb9399387ccf5677d9de
SHA512 eecc2b06dcbf9a108c1c47c0c9c9d509479210bb654c304043f8bbb9ccd78fea9282b499405a261f7eb8890cf64d8e09cb2e45c035976a093ffcbf96ca7c6f69
SSDEEP 12288:avWERGGQ1spq1JuXCt46A9jmP/uhu/yMS08CkntxYR:pEoGQ1spq1TmfmP/UDMS08Ckn3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

ord582 __vbaVarTstGt __vbaVarSub __vbaStrI2 ord583 ord690 __vbaNextEachAry _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaStrVarMove __vbaLateIdCall __vbaLenBstr ord696 __vbaEnd __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 ord519 __vbaCopyBytes __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit ord300 ord594 ord301 ord595 __vbaOnError __vbaObjSet ord302 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 ord306 __vbaForEachCollVar ord520 ord307 ord308 __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaGet3 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar __vbaObjVar __vbaI2I4 __vbaPrintObj DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaLbound _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaStrToUnicode __vbaPrintFile ord713 _adj_fprem _adj_fdivr_m64 __vbaVarDiv ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord536 ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaForEachAry ord689 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup ord613 __vbaFpI2 __vbaFpI4 __vbaVarLateMemCallLd ord616 __vbaLateMemCallLd ord617 _CIatan ord618 __vbaAryCopy __vbaCastObj __vbaStrMove __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaFPInt __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing