General
- Target jaffacakes118_Trojan.Win32.Agent.xaaoyp.43bf898fa43e330564fab3a9c72b141d
- Size 405KB
- Sample261016-ms88jshb27
- SHA256 6869322d2af6fd17b81da5f80eefeba96f9221733db4a5f26d615faaa863d71c
Score
10/10
Malware Config
Targets
-
- Target Order.exe
- Size 660KB
- SHA256 5aaf059cd596adf59752df6f88854145b6e8dfd5ed069d99b1b2c70fb0ce3b96
Score10/10-
Family: Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
-
Kutaki Executable
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1