Overview

overview

10

Static

static

10

121c223861...74.exe

windows7_x64

10

121c223861...74.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    121c223861d712f506d88d5a54a3588c65bec5e4b82b4d3435bb73008a287074

  • Size

    89KB

  • Sample

    220130-rcxa9scahk

  • MD5

    7ee7a9446d7cf886223274d809d375d6

  • SHA1

    17dc2bae830c49cf8ab2c24dedc38f78c7b8a430

  • SHA256

    121c223861d712f506d88d5a54a3588c65bec5e4b82b4d3435bb73008a287074

  • SHA512

    c4e23aa07240675d6bd023863bc6a4d91ee9c9e4e64136db957b8803fde44ffb86b9f6b02db4f2c2f9edb153340d57d1b281331e53418f901fb77919facc2ad9

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      121c223861d712f506d88d5a54a3588c65bec5e4b82b4d3435bb73008a287074

    • Size

      89KB

    • MD5

      7ee7a9446d7cf886223274d809d375d6

    • SHA1

      17dc2bae830c49cf8ab2c24dedc38f78c7b8a430

    • SHA256

      121c223861d712f506d88d5a54a3588c65bec5e4b82b4d3435bb73008a287074

    • SHA512

      c4e23aa07240675d6bd023863bc6a4d91ee9c9e4e64136db957b8803fde44ffb86b9f6b02db4f2c2f9edb153340d57d1b281331e53418f901fb77919facc2ad9

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks