Overview

overview

10

Static

static

10

15040d6621...34.exe

windows7_x64

10

15040d6621...34.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15040d662165e92e0a8b2c2b511f192dd9e3be1e914aeca8850db2b941dd6134

  • Size

    92KB

  • Sample

    220212-e81x4shfar

  • MD5

    2a6beb71ea4a61e32304a6bd8045a3e3

  • SHA1

    b28668396678a79ecb4a5733ef8cf3dcaad6d683

  • SHA256

    15040d662165e92e0a8b2c2b511f192dd9e3be1e914aeca8850db2b941dd6134

  • SHA512

    afe00ebcb1ee1cbf5f27ae78d936b88c7b1efb6d701bbf9d7adabbde3fe08b1af9faf573d5e8c380367cb65ac375810ccc1a7bd28ebe07e4f9de4ba28768c382

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      15040d662165e92e0a8b2c2b511f192dd9e3be1e914aeca8850db2b941dd6134

    • Size

      92KB

    • MD5

      2a6beb71ea4a61e32304a6bd8045a3e3

    • SHA1

      b28668396678a79ecb4a5733ef8cf3dcaad6d683

    • SHA256

      15040d662165e92e0a8b2c2b511f192dd9e3be1e914aeca8850db2b941dd6134

    • SHA512

      afe00ebcb1ee1cbf5f27ae78d936b88c7b1efb6d701bbf9d7adabbde3fe08b1af9faf573d5e8c380367cb65ac375810ccc1a7bd28ebe07e4f9de4ba28768c382

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks