Overview

overview

10

Static

static

10

170ca9d758...3b.exe

windows7_x64

10

170ca9d758...3b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    170ca9d758cc67ed71a8c5bfd1eb0c50bc4da672046496160932df776576cd3b

  • Size

    216KB

  • Sample

    220212-d7r35shban

  • MD5

    a0d63079f81d6c5f5326ca10064dd7de

  • SHA1

    72052adec7eee9e4fdc9e4c4a24dea876803c6cc

  • SHA256

    170ca9d758cc67ed71a8c5bfd1eb0c50bc4da672046496160932df776576cd3b

  • SHA512

    f283699fbe84ea04fbb148e332430cc16e4469545c46f61be65549ea772a71b60d89e2b17458810dc8c21649d60c46c890fface058f2b3e19a8cc975fe7912d6

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      170ca9d758cc67ed71a8c5bfd1eb0c50bc4da672046496160932df776576cd3b

    • Size

      216KB

    • MD5

      a0d63079f81d6c5f5326ca10064dd7de

    • SHA1

      72052adec7eee9e4fdc9e4c4a24dea876803c6cc

    • SHA256

      170ca9d758cc67ed71a8c5bfd1eb0c50bc4da672046496160932df776576cd3b

    • SHA512

      f283699fbe84ea04fbb148e332430cc16e4469545c46f61be65549ea772a71b60d89e2b17458810dc8c21649d60c46c890fface058f2b3e19a8cc975fe7912d6

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks