kutaki | 10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d[.]exe

General

Target
10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d.exe
Size 500KB
Sample241105-csdrja1rdx
SHA256 10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d
MD5 1c0a0f8af63ae1d01f674a15445bc38a
SHA1 4b224a051f75ea361c525f3c64d5a50be03ec0e4
SHA512 45f5b2df88ad94637552bfd2e1b152778d54bb21a3a2bf5052d688cfa74344a29c75ed1af8990620ffe752d793ac270fe449f35ea6cffa20f24195e56b962fa5
SSDEEP 12288:zPCKUFlhDzgX/m46A9jmP/uhu/yMS08CkntxYR:zPvslhDWxfmP/UDMS08Ckn3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Extracted

Family

kutaki

C2

http://treysbeatend.com/laptop/squared.php

Signatures

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d.exe

File Explorer

10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d.exe

.exe 500KB

10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d.exe

IMPHASH 61986fe94bbc6a9f30e3ce5cd51d7d05
SHA256 10bc8552d9b63666e0788161c13213c7275fdf6a0c4d3ba3d155036be3f4222d
MD5 1c0a0f8af63ae1d01f674a15445bc38a
SHA1 4b224a051f75ea361c525f3c64d5a50be03ec0e4
SHA512 45f5b2df88ad94637552bfd2e1b152778d54bb21a3a2bf5052d688cfa74344a29c75ed1af8990620ffe752d793ac270fe449f35ea6cffa20f24195e56b962fa5
SSDEEP 12288:zPCKUFlhDzgX/m46A9jmP/uhu/yMS08CkntxYR:zPvslhDWxfmP/UDMS08Ckn3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 ord690 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaPut3 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 ord518 ord626 ord519 __vbaForEachCollAd __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock ord593 __vbaVarForInit ord594 ord595 __vbaOnError __vbaObjSet ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaForEachCollVar ord520 __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase ord631 __vbaVarCmpGt __vbaVargVarMove ord632 ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError ord529 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaNextEachCollVar __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaR8Cy __vbaRedim __vbaStrR8 EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord714 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 ord537 ord645 _CIlog ord646 __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec ord570 ord648 __vbaR8Str __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaFpCy __vbaAryLock __vbaVarAdd __vbaStrComp __vbaVarDup __vbaStrToAnsi __vbaVarLateMemCallLd ord616 __vbaFpI4 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj ord618 __vbaAryCopy __vbaStrMove __vbaForEachVar ord619 __vbaStrVarCopy __vbaR8IntI4 _allmul _CItan __vbaNextEachCollAd __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing