Overview

overview

10

Static

static

10

TDS Paymen...an.exe

windows7-x64

10

TDS Paymen...an.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c90ad5265c74d984458c02a621d08c2b_JaffaCakes118

  • Size

    395KB

  • Sample

    240829-r8qtcsyhqk

  • MD5

    c90ad5265c74d984458c02a621d08c2b

  • SHA1

    7034f20736cc32ec8640646f88f37f499318d7ee

  • SHA256

    4c8403e48c8fc0203b2472ec3e0d32445528e2081e07a5ae5ccedc8cf6fa1172

  • SHA512

    0f2084c212a7cfd9d17a74442fccf97a44574f7471b00e497fd024548cc05cc2cc48fb71f7c7aaed6d3f88ab8da741c8ee80fd05ab0187d908973fed0d33e2d5

  • SSDEEP

    6144:n7QB8g67xtqYEEJjsR1wY6VVdv8DlSOcwhxewKhgYwjNsFmQq8UX/6S3nAmg:7QB8gNT6dIlSpwhg2snxA6SQh

Score
10/10
kutakidiscoverykeyloggerstealer

Malware Config

Targets

    • Target

      TDS Payment Challan.exe

    • Size

      671KB

    • MD5

      62aea7e47f647f9d6d2cdacb15e4b163

    • SHA1

      884550e92ac4ad9c24f3473d889b9247775f5ee5

    • SHA256

      73a3c2d670bc63cd77c0ccbfd6fc92972531897317c630f26f02ad58dbbf0af3

    • SHA512

      59cdbc399225f2bf6fb3f56cfaa4c3705a0a5f23ae7d59ccf14467c19adc6ef5694fa91afae80ebeedd44ac3974923b6d8c616d87cc55a0d2fd8e2310108c283

    • SSDEEP

      12288:uig7QBOXvCY9PU5KXpGPqlSpwhm4s5bsGSCs5:CEy6gU5KXrlSpnHuGE5

    Score
    10/10
    kutakidiscoverykeyloggerstealer

    • Kutaki

      Information stealer and keylogger that hides inside legitimate Visual Basic applications.

      stealerkeyloggerkutaki

    • Kutaki Executable

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks