Overview

overview

10

Static

static

10

10aebf94f5...05.exe

windows7_x64

10

10aebf94f5...05.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10aebf94f56d966caf79274e031152746e342e3cc55fa7abd793cd2ca8902e05

  • Size

    89KB

  • Sample

    220130-w7zr4agdej

  • MD5

    5a894c18c5cc153f80699145edd1c206

  • SHA1

    84f81e1cc9f030133f3b686f1cf7cf3cea09a193

  • SHA256

    10aebf94f56d966caf79274e031152746e342e3cc55fa7abd793cd2ca8902e05

  • SHA512

    38edf49e44643d986a16c5f1f985b988d223d3f17ab88cd26c8b0fab70fe80cc7f02fbcbf1d57a93ce9eec1b74a10d12632c7158013eaa58474de8c28274d3ee

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      10aebf94f56d966caf79274e031152746e342e3cc55fa7abd793cd2ca8902e05

    • Size

      89KB

    • MD5

      5a894c18c5cc153f80699145edd1c206

    • SHA1

      84f81e1cc9f030133f3b686f1cf7cf3cea09a193

    • SHA256

      10aebf94f56d966caf79274e031152746e342e3cc55fa7abd793cd2ca8902e05

    • SHA512

      38edf49e44643d986a16c5f1f985b988d223d3f17ab88cd26c8b0fab70fe80cc7f02fbcbf1d57a93ce9eec1b74a10d12632c7158013eaa58474de8c28274d3ee

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks