Overview

overview

10

Static

static

10

29fce7d6b0...6d.exe

windows7_x64

10

29fce7d6b0...6d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    29fce7d6b08acaf601c149c254fa3184556ff544bb20c90b9664ebdf85cc3a6d

  • Size

    89KB

  • Sample

    220122-a7b55sgabm

  • MD5

    bc74a557e91597d8b37ed357c367643e

  • SHA1

    0f7ccd39a0c4c5846da1dc5330c918316c917da8

  • SHA256

    29fce7d6b08acaf601c149c254fa3184556ff544bb20c90b9664ebdf85cc3a6d

  • SHA512

    88f9d398a7a806bde6be8bfd743848b7d72ed28c39f969f7e594358a602c707a2e1dc0d3691af58c7d379f26745973cb3320bc46c24d2110115e4448219cb89e

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      29fce7d6b08acaf601c149c254fa3184556ff544bb20c90b9664ebdf85cc3a6d

    • Size

      89KB

    • MD5

      bc74a557e91597d8b37ed357c367643e

    • SHA1

      0f7ccd39a0c4c5846da1dc5330c918316c917da8

    • SHA256

      29fce7d6b08acaf601c149c254fa3184556ff544bb20c90b9664ebdf85cc3a6d

    • SHA512

      88f9d398a7a806bde6be8bfd743848b7d72ed28c39f969f7e594358a602c707a2e1dc0d3691af58c7d379f26745973cb3320bc46c24d2110115e4448219cb89e

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks