Overview

overview

10

Static

static

10

190bf8fddb...68.exe

windows7_x64

10

190bf8fddb...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    190bf8fddb5a7fb9328de25d5bae225d0a06e8f67d8afb8c622d1c0980fdec68

  • Size

    176KB

  • Sample

    220212-dew7dsgfhp

  • MD5

    b21db582e4cf27142888b14aecf4883e

  • SHA1

    5e75f1e58d450c9a078526e353623deca2ee8e37

  • SHA256

    190bf8fddb5a7fb9328de25d5bae225d0a06e8f67d8afb8c622d1c0980fdec68

  • SHA512

    718e5053c6192eefe5aebfca132e6b0da2783ec643d5da6510a48f5222d7e71f7cedbe01f41c7da728e4d731cd5416a0195d088d74828bb884ac65601202ae46

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      190bf8fddb5a7fb9328de25d5bae225d0a06e8f67d8afb8c622d1c0980fdec68

    • Size

      176KB

    • MD5

      b21db582e4cf27142888b14aecf4883e

    • SHA1

      5e75f1e58d450c9a078526e353623deca2ee8e37

    • SHA256

      190bf8fddb5a7fb9328de25d5bae225d0a06e8f67d8afb8c622d1c0980fdec68

    • SHA512

      718e5053c6192eefe5aebfca132e6b0da2783ec643d5da6510a48f5222d7e71f7cedbe01f41c7da728e4d731cd5416a0195d088d74828bb884ac65601202ae46

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks