Overview

overview

10

Static

static

10

14e24de9a3...01.exe

windows7_x64

10

14e24de9a3...01.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14e24de9a3ccde5efe7020d1622a74c8deadf83464c09e9148ad7819686d5601

  • Size

    168KB

  • Sample

    220212-e99awahfbq

  • MD5

    b7e8f41e681092c884506d73ab6f0648

  • SHA1

    3795dd2a7bc8635018a0e65394641ebf6005d1d1

  • SHA256

    14e24de9a3ccde5efe7020d1622a74c8deadf83464c09e9148ad7819686d5601

  • SHA512

    309c30ccc92c33da1b4bd728a544db173fea0c61ef660de8d66ca96ec6e3ac5de50c56b135d3f9bd821c3416879e30f36b8259a6cd97f5ee6ab3178b0daf8aba

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      14e24de9a3ccde5efe7020d1622a74c8deadf83464c09e9148ad7819686d5601

    • Size

      168KB

    • MD5

      b7e8f41e681092c884506d73ab6f0648

    • SHA1

      3795dd2a7bc8635018a0e65394641ebf6005d1d1

    • SHA256

      14e24de9a3ccde5efe7020d1622a74c8deadf83464c09e9148ad7819686d5601

    • SHA512

      309c30ccc92c33da1b4bd728a544db173fea0c61ef660de8d66ca96ec6e3ac5de50c56b135d3f9bd821c3416879e30f36b8259a6cd97f5ee6ab3178b0daf8aba

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks