MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Kutaki


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
SHA3-384 hash: c1b247e18e58a6d7b628c2f23b9aea05032f3cb4669cb213ca0dc15148d2841369b623a078b2e71258c088b22ffa3519
SHA1 hash: 3f62736088952839a2379bb33575fc1e963e784e
MD5 hash: 3636153d8fdc065fc40aae264f39eb7f
humanhash: virginia-carpet-failed-nebraska
File name:a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27
Download: download sample
Signature Kutaki
Create hunting rule
File size:761'414 bytes
First seen:2020-08-05 11:29:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 96c066e41a4ce8400f2d986131b7bc00 (1 x Kutaki)
ssdeep 12288:pUTq7ZKSOkkd+kQpGPqlSpwhm4s5bsGSCs5:u0ZIkkd+LrlSpnHuGE5
Threatray 605 similar samples on MalwareBazaar
TLSH C6F4F992F369D4BCFC4A05F730737A89780949365BCD5D03AA10A58B043E397FA95E2B
Reporter JAMESWT_WT
Tags:keylogger Kutaki spy

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39434/
Detection(s):
SecuriteInfo.com.Trojan.Siggen8.10260.5223.6973.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Running batch commands
Creating a process with a hidden window
Sending a UDP request
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Threat name:
Kutaki
Create hunting rule
Detection:
malicious
Classification:
adwa.spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/410951
Signature
Drops PE files to the startup folder
Machine Learning detection for dropped file
Machine Learning detection for sample
Yara detected AntiVM strings in reverse order
Yara detected Kutaki Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 257637 Sample: o5UQHClyOH Startdate: 05/08/2020 Architecture: WINDOWS Score: 68 35 Yara detected Kutaki Keylogger 2->35 37 Yara detected AntiVM strings in reverse order 2->37 39 Machine Learning detection for sample 2->39 41 Machine Learning detection for dropped file 2->41 8 o5UQHClyOH.exe 14 2->8         started        12 lunlerio.exe 12 2->12         started        process3 file4 27 C:\Users\user\AppData\...\lunlerio.exe, PE32 8->27 dropped 43 Drops PE files to the startup folder 8->43 14 lunlerio.exe 6 92 8->14         started        18 cmd.exe 1 8->18         started        signatures5 process6 dnsIp7 33 babaobadf.club 91.223.82.89, 49737, 49738, 49744 IWSNETSE Netherlands 14->33 29 C:\Users\user\AppData\Local\Temp\c.exe, PE32 14->29 dropped 20 c.exe 1 14->20         started        23 conhost.exe 18->23         started        file8 process9 dnsIp10 31 janawe.bid 20->31 25 conhost.exe 20->25         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27/
Threat name:
Win32.Trojan.Antivm
Create hunting rule
Status:
Malicious
First seen:
2019-03-03 11:38:00 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
5a37dbecf825521597ec511ae03e854c8000c9b6220db8f10bf18415fa856a90
Kutaki
5f9b8ce62abc0d49b1bb253bd51286151a8b3d3f09fdb9e37cd964f80df26669
Kutaki
7c267f393664ccc38c7a4fb521587e77db7fc7e3a157a9ef5c19783f03a67c76
Kutaki
8533f6030709d8f590c3e50dd87edf7cc841d2b4b455e209a7999c0ef1b1d743
Kutaki
a45d9c8d3f5ceb809b8ee497e806d29d6e379ae0603aea8b733096afcf86bdcc
Kutaki
aa3420190b3e22959cfb4715307027404fe5cb492faf5546189a20b82b9e4e37
Kutaki
b1d1654f14052fe13960bbde4280f2f1d34e802293dddb47c971ce833bb5bda5
Kutaki
c0b3f80b09b6851a3dd4ba2a7bd1ef106779f671b324dd4f490c6dbdb8865ec5
Kutaki
c9dae8af9343e2bb59a9c6cbfa04b09bcbffe2a75893d797ec2a9c50c6253afe
Kutaki
fcce249643f7fe240695fdbc393b54a543fa4a49942b56ad8aad6f219c4f896d
Kutaki
+ 595 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200805-k11vh8yarj/
Behaviour
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Maps connected drives based on registry
Maps connected drives based on registry
Loads dropped DLL
Drops startup file
Drops startup file
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6f34907ae34f485e4091ba122886cb32a2cc27856d580fe289c8861d6241f27

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/39434/

Comments