Overview

overview

10

Static

static

d4be6c9117...8d.exe

windows7_x64

10

d4be6c9117...8d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d

  • Size

    438KB

  • Sample

    220130-1mf7gabafj

  • MD5

    230d8a7a60a07df28a291b13ddf3351f

  • SHA1

    de71fd21781ae1eed0dbba6bf915a65cc4c0f984

  • SHA256

    d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d

  • SHA512

    b3305950a8d24b247a16b35d49f53dfbc367332879ddafcb7d95a1c44ec02f7ed66d26acbf9992bf39193094c7bbefcbbe59ae514619491e148bb59cb32ddf01

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d

    • Size

      438KB

    • MD5

      230d8a7a60a07df28a291b13ddf3351f

    • SHA1

      de71fd21781ae1eed0dbba6bf915a65cc4c0f984

    • SHA256

      d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d

    • SHA512

      b3305950a8d24b247a16b35d49f53dfbc367332879ddafcb7d95a1c44ec02f7ed66d26acbf9992bf39193094c7bbefcbbe59ae514619491e148bb59cb32ddf01

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

      suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

      suricata

    • suricata: ET MALWARE Possible Deep Panda User-Agent

      suricata: ET MALWARE Possible Deep Panda User-Agent

      suricata

    • suricata: ET MALWARE Sakula/Mivast C2 Activity

      suricata: ET MALWARE Sakula/Mivast C2 Activity

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks