MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 43ca8605af17f08bd6e9dc30aa7ab1d206d501160040e5a8a085f46d2e01f2c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 43ca8605af17f08bd6e9dc30aa7ab1d206d501160040e5a8a085f46d2e01f2c9 |
|---|---|
| SHA3-384 hash: | 4a446d17e3939bca353cbf097d7803ff9743ba34388ff7efabc4c381905e09d240b03b655482264934d8369d2d6bbd71 |
| SHA1 hash: | d5a6b7229e68b730ef5800150d93b31f15bd634d |
| MD5 hash: | 8c5e74cc1b2e3add30fbc32df07f9735 |
| humanhash: | sixteen-hydrogen-sixteen-oscar |
| File name: | DHL Tracking.exe |
| Download: | download sample |
| File size: | 434'176 bytes |
| First seen: | 2020-12-28 17:39:37 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | b14f4a4790b2f60cb9f4b71496d7f78c |
| ssdeep | 12288:Qu2NwMwwhp2T46A9jmP/uhu/yMS08CkntxYRQ:Q/fmP/UDMS08Ckn3l |
| Threatray | 4'679 similar samples on MalwareBazaar |
| TLSH | 5194E026B7A20E43DADA59B15E9385F073B3BD8B0B53020B7A4572BE6862F111C55B0F |
| Reporter |  abuse_ch |
| Tags: | DHL exe |
abuse_ch
Malspam distributing unidentified malware:HELO: server.ninja-host.com
Sending IP: 5.189.132.239
From: DHL Customer Service<info@iccl-eg.com>
Reply-To: <fedny2016@gmail.com>
Subject: Re: DHL Invoice attached !!!
Attachment: DHL Tracking.zip (contains "DHL Tracking.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL Tracking.exe
Verdict:
Malicious activity
Analysis date:
2020-12-28 17:40:40 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Using the Windows Management Instrumentation requests
Running batch commands
Creating a process with a hidden window
Creating a file
Searching for the window
Deleting a recently created file
Replacing files
Creating a process from a recently created file
Sending a UDP request
Enabling autorun by creating a file
Result
Threat name:
Kutaki
Detection:
malicious
Classification:
rans.spyw
Score:
68 / 100
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Potential malicious icon found
Yara detected Kutaki Keylogger
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Ymacco
Status:
Malicious
First seen:
2020-12-28 17:40:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 4'669 additional samples on MalwareBazaar
Result
Malware family:
kutaki
Score:
10/10
Tags:
family:kutaki keylogger stealer
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops startup file
Loads dropped DLL
Executes dropped EXE
Kutaki
Kutaki Executable
Unpacked files
SH256 hash:
43ca8605af17f08bd6e9dc30aa7ab1d206d501160040e5a8a085f46d2e01f2c9
MD5 hash:
8c5e74cc1b2e3add30fbc32df07f9735
SHA1 hash:
d5a6b7229e68b730ef5800150d93b31f15bd634d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 43ca8605af17f08bd6e9dc30aa7ab1d206d501160040e5a8a085f46d2e01f2c9
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.