Overview

overview

10

Static

static

10

8ad94e962e...ca.exe

windows7_x64

10

8ad94e962e...ca.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ad94e962e98625d4f731bfe8bad354f9d656b5872cd2cfe1722cfffa9b85aca

  • Size

    89KB

  • Sample

    220122-bcat9sgcej

  • MD5

    b31e97c9740d8e95e56a5957777830d7

  • SHA1

    2c738b7c6b4b0bb76a62b2af5d599a75bfad7f3d

  • SHA256

    8ad94e962e98625d4f731bfe8bad354f9d656b5872cd2cfe1722cfffa9b85aca

  • SHA512

    072a06e3eefabcfe6e812f4d1ae40accbaadc67f3def7f16a7dd3aae79fcbc927cc5e2f8f517c2689ceb742b516d81ab1e0395a6e7c92c2afe2ab5d4cbfa2992

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      8ad94e962e98625d4f731bfe8bad354f9d656b5872cd2cfe1722cfffa9b85aca

    • Size

      89KB

    • MD5

      b31e97c9740d8e95e56a5957777830d7

    • SHA1

      2c738b7c6b4b0bb76a62b2af5d599a75bfad7f3d

    • SHA256

      8ad94e962e98625d4f731bfe8bad354f9d656b5872cd2cfe1722cfffa9b85aca

    • SHA512

      072a06e3eefabcfe6e812f4d1ae40accbaadc67f3def7f16a7dd3aae79fcbc927cc5e2f8f517c2689ceb742b516d81ab1e0395a6e7c92c2afe2ab5d4cbfa2992

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks