MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0401d7fd0924a8ebf835b1ba3940dd66f49810d442277ff15ac50c517f00c788. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Kutaki
Vendor detections: 9
| SHA256 hash: | 0401d7fd0924a8ebf835b1ba3940dd66f49810d442277ff15ac50c517f00c788 |
|---|---|
| SHA3-384 hash: | 59690c3ab7cb3d1ef40096fad4cccb3b7ab74eb45d3b5269b96ac3b01f9f597a6dc28cbcd5ac98b11c1c3ee9dcdb276b |
| SHA1 hash: | 49fe836cf08a3feaf6f2aa2f74ab14eadc0ab7dd |
| MD5 hash: | b67c3ccdf2d0675e64e045931d26991e |
| humanhash: | failed-alpha-fifteen-west |
| File name: | RTGS Payment Confirmation.exe |
| Download: | download sample |
| Signature | Kutaki |
| File size: | 851'968 bytes |
| First seen: | 2022-04-14 08:52:56 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ae6b891cbf9aa95048be52404a6e1f7b (1 x Kutaki) |
| ssdeep | 12288:Oc1zg3bUZIycPkE00AAbpfLd7QcX4kB46A9jmP/uhu/yMS08CkntxYR+:OVoZ1mpfLd7ofmP/UDMS08Ckn3H |
| Threatray | 38 similar samples on MalwareBazaar |
| TLSH | T1E6059C13A612B01AF562F4F02924F2C517282F760587A697EBB13B4632B1DD776E032F |
| TrID | 75.8% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8) 9.7% (.EXE) Win64 Executable (generic) (10523/12/4) 4.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.1% (.EXE) Win32 Executable (generic) (4505/5/1) 1.8% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | ec6ce4c4c8d4b0c0 (1 x Kutaki) |
| Reporter |  GovCERT_CH |
| Tags: | exe Kutaki |
Intelligence
File Origin
# of uploads :
1
# of downloads :
313
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
RTGS Payment Confirmation.exe
Verdict:
Suspicious activity
Analysis date:
2022-04-14 09:01:38 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Kutaki
Verdict:
Malicious
Result
Threat name:
Kutaki
Detection:
malicious
Classification:
spyw
Score:
72 / 100
Signature
Antivirus / Scanner detection for submitted sample
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Kutaki Keylogger
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2022-04-14 01:11:16 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 28 additional samples on MalwareBazaar
Result
Malware family:
kutaki
Score:
10/10
Tags:
family:kutaki
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
0401d7fd0924a8ebf835b1ba3940dd66f49810d442277ff15ac50c517f00c788
MD5 hash:
b67c3ccdf2d0675e64e045931d26991e
SHA1 hash:
49fe836cf08a3feaf6f2aa2f74ab14eadc0ab7dd
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.