General
- Target jaffacakes118_Trojan.Win32.Agent.qwigfm.d6a61057a219dda65f634ef3169f8c67
- Size 379KB
- Sample261016-msry9sw14n
- SHA256 837e689ba1b4eedcef2f970c97d453e8ee03a10ed5149bd6d7340d3681d8603a
Score
10/10
Malware Config
Targets
-
- Target GST Payment Challan.exe
- Size 743KB
- SHA256 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
Score10/10-
Family: Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
-
Kutaki Executable
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1