Overview

overview

10

Static

static

10

155bd0f729...14.exe

windows7_x64

10

155bd0f729...14.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    155bd0f729c43026ce397d2d8b025ddbefe6e30d2e2fbec911abdb9d7bd3f714

  • Size

    176KB

  • Sample

    220212-e1k7pahedk

  • MD5

    0066b127b1fd325ba74a5a4034256b47

  • SHA1

    16020093b1ceddf0698f5b13e640984e5062bce4

  • SHA256

    155bd0f729c43026ce397d2d8b025ddbefe6e30d2e2fbec911abdb9d7bd3f714

  • SHA512

    9d70ad5cfe97bfe06a71d4144eb672dd99dc78a3655d83fef0aef2f7e0617873aa7b64cc1e6ce070b872e6b75060eae1e0a55e28cfd8cc336beaac5e59a3279c

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      155bd0f729c43026ce397d2d8b025ddbefe6e30d2e2fbec911abdb9d7bd3f714

    • Size

      176KB

    • MD5

      0066b127b1fd325ba74a5a4034256b47

    • SHA1

      16020093b1ceddf0698f5b13e640984e5062bce4

    • SHA256

      155bd0f729c43026ce397d2d8b025ddbefe6e30d2e2fbec911abdb9d7bd3f714

    • SHA512

      9d70ad5cfe97bfe06a71d4144eb672dd99dc78a3655d83fef0aef2f7e0617873aa7b64cc1e6ce070b872e6b75060eae1e0a55e28cfd8cc336beaac5e59a3279c

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks