MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 801aff832240d9b440bcd8fb1244c03b328a91035a69de29ba8421b82e077ca3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kutaki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 801aff832240d9b440bcd8fb1244c03b328a91035a69de29ba8421b82e077ca3
SHA3-384 hash: 5e22dacbb94fb1c1c7ef7b97f447b46fb6b402a916be52f41696436b9c06d55e2fbf4fc57da6fb68f5e886bb2150214a
SHA1 hash: 33700cc1d44d7b7843c38726657d666a0c6d2e4a
MD5 hash: 6db4d90b4364d7b34186aaac3d278713
humanhash: utah-king-video-fruit
File name:801aff832240d9b440bcd8fb1244c03b328a91035a69de29ba8421b82e077ca3
Download: download sample
Signature Kutaki
Create hunting rule
File size:679'494 bytes
First seen:2020-08-05 11:29:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ca3a500cf1a825d25cdec721d027e36e (1 x Kutaki)
ssdeep 12288:NwNJETA7Z9FtWiupGPqlSpwhm4s5bsGSCs5:WNJETAjFtWiurlSpnHuGE5
Threatray 816 similar samples on MalwareBazaar
TLSH 95E40A95F368E87CFD5A08F730637A89B84949369BCD5D036900A18F043E397F791E6A
Reporter JAMESWT_WT
Tags:keylogger Kutaki spy

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39433/
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Win.Malware.Midie-6910312-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Sending a UDP request
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Threat name:
Kutaki
Create hunting rule
Detection:
malicious
Classification:
adwa.spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/410950
Signature
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Yara detected AntiVM strings in reverse order
Yara detected Kutaki Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 257636 Sample: jW8LvpkHjo Startdate: 05/08/2020 Architecture: WINDOWS Score: 68 37 Yara detected Kutaki Keylogger 2->37 39 Yara detected AntiVM strings in reverse order 2->39 41 Machine Learning detection for sample 2->41 43 Machine Learning detection for dropped file 2->43 8 jW8LvpkHjo.exe 14 2->8         started        12 yeshydhf.exe 12 2->12         started        process3 file4 27 C:\Users\user\AppData\...\yeshydhf.exe, PE32 8->27 dropped 45 Drops PE files to the startup folder 8->45 14 yeshydhf.exe 6 115 8->14         started        18 cmd.exe 1 8->18         started        signatures5 process6 dnsIp7 35 babaobadf.club 91.223.82.89, 49719, 49726, 49727 IWSNETSE Netherlands 14->35 29 C:\Users\user\AppData\Local\Temp\c.exe, PE32 14->29 dropped 20 c.exe 1 14->20         started        23 conhost.exe 18->23         started        file8 process9 dnsIp10 31 192.168.2.1 unknown unknown 20->31 33 janawe.bid 20->33 25 conhost.exe 20->25         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/801aff832240d9b440bcd8fb1244c03b328a91035a69de29ba8421b82e077ca3/
Threat name:
Win32.Trojan.Johnnie
Create hunting rule
Status:
Malicious
First seen:
2019-03-20 05:30:29 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0ec3c68f6fa845bcc40ea35365aa204f7e8bdf8010ea20dec2e3ea3f46838e02
Kutaki
2ed2a56967e7cb3e18b8b2cb910b9e6d356a52a9b65a05309c36ec62fa09773c
Kutaki
3667b7518f2634bfd589f12fe1fd6e7ec1701030529dd3ece0b04705e76e5e06
Kutaki
37a3468d527e22a4cdd0c1e8717a5bca60db2cd8aaace1a4d25b65eeccd8079c
Kutaki
40c27e805186cc26240cbf37d1d2809412c42e2a3610fdff32cf5b8ce35459e2
Kutaki
a570592bf5a21c1f55712fcec60a0536fedabe28b409d9a48fdc499185e154ff
Kutaki
bbb38a432f7eff2a12b72c3ed853e937fbf5d7b9bd23b9f8ab61beb6bd594c10
Kutaki
c688c6b0f5bd44c8d37e810000892ce8d0e2225f1dd04a92d454fd60c7cdc779
Kutaki
ccfc389f6dd3e6d9974b6cd4bb2a2efa5eb060f48e784aabd21a723cb58ff063
Kutaki
da52dddf3fb5de8859dd962bc96eeb267fc4e723682c3defec35672be1441e5e
Kutaki
+ 806 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200805-yse9ftbd6j/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Maps connected drives based on registry
Maps connected drives based on registry
Loads dropped DLL
Drops startup file
Drops startup file
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Vcrypt
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/801aff832240d9b440bcd8fb1244c03b328a91035a69de29ba8421b82e077ca3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Kutaki

Executable exe 801aff832240d9b440bcd8fb1244c03b328a91035a69de29ba8421b82e077ca3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/165132/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/39433/

Comments