Overview

overview

10

Static

static

10

16b072008a...36.exe

windows7_x64

10

16b072008a...36.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16b072008a788254098d5feff4cccdc8d66c50ef9f73699cccaf0e8196af9436

  • Size

    151KB

  • Sample

    220212-ed5mtahbhn

  • MD5

    36b0621deacb33496be6463dcb8391ea

  • SHA1

    eba22b914de62459ea434e706739d37773ec76f0

  • SHA256

    16b072008a788254098d5feff4cccdc8d66c50ef9f73699cccaf0e8196af9436

  • SHA512

    0a4acce7545e7d4e7195977a76b4fc25cf02c63386ebd2fab4a0a47425cc6499da87c182a48635ad9e743a0c5c3ea6b5170c0d5f97bc6942c288a97946e64226

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      16b072008a788254098d5feff4cccdc8d66c50ef9f73699cccaf0e8196af9436

    • Size

      151KB

    • MD5

      36b0621deacb33496be6463dcb8391ea

    • SHA1

      eba22b914de62459ea434e706739d37773ec76f0

    • SHA256

      16b072008a788254098d5feff4cccdc8d66c50ef9f73699cccaf0e8196af9436

    • SHA512

      0a4acce7545e7d4e7195977a76b4fc25cf02c63386ebd2fab4a0a47425cc6499da87c182a48635ad9e743a0c5c3ea6b5170c0d5f97bc6942c288a97946e64226

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks