Kutaki
- Malware type
- backdoor, credential-stealer, trojan
- Last IoC activity
- 2026-07-20 12:57:41
- Profile updated
- 2026-07-07 15:09:04
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical
Context
Cofense characterizes Kutaki as a data stealer that uses old-school techniques to detect sandboxes and debugging. Kutaki however works quite well against unhardened virtual machines and other analysis devices. By backdooring a legitimate application, it can fool unsophisticated detection methodologies.
Detection coverage
- 2 YARA rules
Detection rules
- DITEKSHEN_MALWARE_Win_Kutaki (yara-rule)
- MALPEDIA_Win_Kutaki_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Kutaki (report)
- cofense.com — Kutaki Malware Bypasses Gateways Steal Users Credentials (report)
- sequretek.com — Kutaki Stealer Analysis (report)