Overview

overview

10

Static

static

10

7777996703...85.exe

windows7_x64

10

7777996703...85.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7777996703326ba738bf90d4b0b2fc302cb395f1f03e628c47cdec113bdfcf85

  • Size

    89KB

  • Sample

    220130-w5lsfsgdan

  • MD5

    5b76c68f9ca61bfd8a5bcbf2817a1437

  • SHA1

    1f523f98e28063463ff402ac39bcea28da8661b5

  • SHA256

    7777996703326ba738bf90d4b0b2fc302cb395f1f03e628c47cdec113bdfcf85

  • SHA512

    a479a38c66899e2341abbe422348aa26f43a37b83c12b59177cd9f34cedf293ee42daef6d533d4ed01f37f99a681995ac05cfd8ed08c6dd7183609776992d56e

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      7777996703326ba738bf90d4b0b2fc302cb395f1f03e628c47cdec113bdfcf85

    • Size

      89KB

    • MD5

      5b76c68f9ca61bfd8a5bcbf2817a1437

    • SHA1

      1f523f98e28063463ff402ac39bcea28da8661b5

    • SHA256

      7777996703326ba738bf90d4b0b2fc302cb395f1f03e628c47cdec113bdfcf85

    • SHA512

      a479a38c66899e2341abbe422348aa26f43a37b83c12b59177cd9f34cedf293ee42daef6d533d4ed01f37f99a681995ac05cfd8ed08c6dd7183609776992d56e

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks