Overview

overview

10

Static

static

10

14fb8fcd46...92.exe

windows7_x64

10

14fb8fcd46...92.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14fb8fcd4656d2e2ba9444a0eb952264a13d47a67f4e6c65dc064ff4bee39c92

  • Size

    216KB

  • Sample

    220212-e9gkvshfbl

  • MD5

    2bd8662c5f410bb778aefa14ba7f1242

  • SHA1

    2f923171086d16751ec97de2e3820ac04af62353

  • SHA256

    14fb8fcd4656d2e2ba9444a0eb952264a13d47a67f4e6c65dc064ff4bee39c92

  • SHA512

    3efdaf9ed6ac1a885bb289d48f1d9dea3b8fdfa678fd9a31ee5a0a274f3c7c3f6ba2c4c7de8355cf273a5ab8aa2e7ea8c3d1def20f428fa78984c1b72c7dd613

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      14fb8fcd4656d2e2ba9444a0eb952264a13d47a67f4e6c65dc064ff4bee39c92

    • Size

      216KB

    • MD5

      2bd8662c5f410bb778aefa14ba7f1242

    • SHA1

      2f923171086d16751ec97de2e3820ac04af62353

    • SHA256

      14fb8fcd4656d2e2ba9444a0eb952264a13d47a67f4e6c65dc064ff4bee39c92

    • SHA512

      3efdaf9ed6ac1a885bb289d48f1d9dea3b8fdfa678fd9a31ee5a0a274f3c7c3f6ba2c4c7de8355cf273a5ab8aa2e7ea8c3d1def20f428fa78984c1b72c7dd613

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks