Overview

overview

10

Static

static

10

de8f6ef702...70.exe

windows7_x64

10

de8f6ef702...70.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de8f6ef7026669e4e31bce66b7477a16e9e3d804d3618a5716e0bac2472b2a70

  • Size

    89KB

  • Sample

    220130-zg6z9saddj

  • MD5

    3859b0ea4596d8f47677497d09bcc894

  • SHA1

    e71caf1ac227478f4a95dc89170ca0f0dd755c72

  • SHA256

    de8f6ef7026669e4e31bce66b7477a16e9e3d804d3618a5716e0bac2472b2a70

  • SHA512

    e175e12a6b01ae3ae04840bfd9b80211aadd0c2ff1100bc3aa6ed1ac1a71544873a54f258139645b272758cc89a4cb04733e2aed16fd2d6e77615533891cfb04

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      de8f6ef7026669e4e31bce66b7477a16e9e3d804d3618a5716e0bac2472b2a70

    • Size

      89KB

    • MD5

      3859b0ea4596d8f47677497d09bcc894

    • SHA1

      e71caf1ac227478f4a95dc89170ca0f0dd755c72

    • SHA256

      de8f6ef7026669e4e31bce66b7477a16e9e3d804d3618a5716e0bac2472b2a70

    • SHA512

      e175e12a6b01ae3ae04840bfd9b80211aadd0c2ff1100bc3aa6ed1ac1a71544873a54f258139645b272758cc89a4cb04733e2aed16fd2d6e77615533891cfb04

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks