MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kutaki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43
SHA3-384 hash: bf0e997f891c186aed3e582bc3b32e00d536b7bc24db5ce9eebdef5f1f699c0d2ca3e72b8c7681e84ba407593968f327
SHA1 hash: 21feb4b15793d506137493ff88a392fdeb9749d5
MD5 hash: 48031ca3ef3a85ee472fbc72c42187e5
humanhash: music-mike-seven-seventeen
File name:736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43
Download: download sample
Signature Kutaki
Create hunting rule
File size:1'003'078 bytes
First seen:2020-08-05 11:29:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 931a6cabf821860cc33eafdda4d9de5b (1 x Kutaki)
ssdeep 6144:i+kS/LfnR2BkgHwtpgoAbMLok9R3x/Brsj1E+6VVPviDlSOcwhxAwOhgYwjtsFQx:5N5+J8RcpGPqlSpwhm4s5bsGSCs5
Threatray 673 similar samples on MalwareBazaar
TLSH 8A2573D3F213EC5FFB1198B92012BAA978CA277EC7EB5472A894955F403D3937704A12
Reporter JAMESWT_WT
Tags:keylogger Kutaki spy

Intelligence

File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39432/
Detection(s):
Win.Malware.Johnnie-6857178-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Sending a UDP request
Creating a process from a recently created file
Creating a file
Searching for the window
Deleting a recently created file
Replacing files
Enabling autorun by creating a file
Result
Threat name:
Kutaki
Create hunting rule
Detection:
malicious
Classification:
rans.adwa.spyw.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/410947
Signature
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Potential malicious icon found
Yara detected AntiVM strings in reverse order
Yara detected Kutaki Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 257635 Sample: xCLsEGAH3C Startdate: 05/08/2020 Architecture: WINDOWS Score: 76 41 Potential malicious icon found 2->41 43 Yara detected Kutaki Keylogger 2->43 45 Yara detected AntiVM strings in reverse order 2->45 47 2 other signatures 2->47 8 xCLsEGAH3C.exe 14 2->8         started        12 hyuder.exe 12 2->12         started        process3 file4 31 C:\Users\user\AppData\Roaming\...\hyuder.exe, PE32 8->31 dropped 49 Drops PE files to the startup folder 8->49 14 hyuder.exe 6 99 8->14         started        18 cmd.exe 1 8->18         started        signatures5 process6 dnsIp7 37 babaobadf.club 91.223.82.89, 49737, 49738, 49739 IWSNETSE Netherlands 14->37 39 192.168.2.1 unknown unknown 14->39 33 C:\Users\user\AppData\Local\Temp\c.exe, PE32 14->33 dropped 20 c.exe 1 14->20         started        23 MpCmdRun.exe 1 18->23         started        25 conhost.exe 18->25         started        file8 process9 dnsIp10 35 janawe.bid 20->35 27 conhost.exe 20->27         started        29 conhost.exe 23->29         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43/
Threat name:
Win32.Trojan.Johnnie
Create hunting rule
Status:
Malicious
First seen:
2019-01-23 18:38:58 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
40 of 48 (83.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
00561595f71768d7555b2a39fc0fd39819640b8b08af4302ba03bf8b3dffa8b2
Kutaki
2ea5a4fb25528051254f255dc64913ca7d4faa1ecba2f40a55b536f871624fb9
Kutaki
4c7955fd946f9b823079ac10f83004c396d5b9877703b5ac2a073a52d8fcd376
Kutaki
4fbe77777093608a25b248db192e96bb062da46835e2739c07922c39cfbb0d57
Kutaki
5c883c457a3dc0ddd6ae66380087c57fb714bdf90ff79185ae0cac329677fe26
Kutaki
77985fca7ae6b60c8025ba326e3bd1d9949c3fb32b9ca0f99f040be633823a7c
Kutaki
b3ea819ddfabf3e2060d9f8116e0952654d5bcdb5716f84ad142a6ab979b521a
Kutaki
bb6cfee282efc5fa0e2dd8de410f4f7b9e684a3378244948589516d9ffaa81ad
Kutaki
bbcb85929cfc7f9761b8bbbd06f473b2ad14b885e1cc2874c2f94d14af2b0b6a
Kutaki
d0c571182eb67023db9b2f8c440dfc76488b23ea51819de40bbeca16fbb9322e
Kutaki
+ 663 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200805-7vealht5gn/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Maps connected drives based on registry
Maps connected drives based on registry
Loads dropped DLL
Drops startup file
Drops startup file
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/736cb1644adf35fc139e7031d9bc5073816784d21b34de83260387f47f13ba43

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/39432/

Comments