Overview

overview

10

Static

static

10

45baa71f47...8d.exe

windows7_x64

10

45baa71f47...8d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45baa71f4743df6033b0d168ba7fbb6a98b4fbf726db6f2e324be356ec4e0e8d

  • Size

    89KB

  • Sample

    220130-15wd4sbceq

  • MD5

    1856a6a28621f241698e4e4287cba7c9

  • SHA1

    18ff92ea12c8b1967e248791241b4e3d41b2ce6c

  • SHA256

    45baa71f4743df6033b0d168ba7fbb6a98b4fbf726db6f2e324be356ec4e0e8d

  • SHA512

    72a6ab9b740e8b51be30deba9b1909b3dd67e343a8536488f818cb6b465a926ef070dde185111cdf6b0427d8e8513a2f859fc4ae1c68bebc6e220599885ea202

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      45baa71f4743df6033b0d168ba7fbb6a98b4fbf726db6f2e324be356ec4e0e8d

    • Size

      89KB

    • MD5

      1856a6a28621f241698e4e4287cba7c9

    • SHA1

      18ff92ea12c8b1967e248791241b4e3d41b2ce6c

    • SHA256

      45baa71f4743df6033b0d168ba7fbb6a98b4fbf726db6f2e324be356ec4e0e8d

    • SHA512

      72a6ab9b740e8b51be30deba9b1909b3dd67e343a8536488f818cb6b465a926ef070dde185111cdf6b0427d8e8513a2f859fc4ae1c68bebc6e220599885ea202

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks