Overview

overview

10

Static

static

10

1687bc0738...95.exe

windows7_x64

10

1687bc0738...95.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1687bc0738560d9d615f5715ca377841fd87f86d6304201c66767a87670d3d95

  • Size

    150KB

  • Sample

    220212-egb5nshcbl

  • MD5

    9aa9cf034deaf46ad4714d3ddab92f9e

  • SHA1

    ed1ac2d3a7c099245c3b4756a50833bae6941e0b

  • SHA256

    1687bc0738560d9d615f5715ca377841fd87f86d6304201c66767a87670d3d95

  • SHA512

    e802caa7da6014ba7062a14504b96947a4bed82c046c222fee57931e76e74171d0edeae1a8e3efabf1b345936a4cc7371e343437ecd08a2a1009e20e662a6e85

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1687bc0738560d9d615f5715ca377841fd87f86d6304201c66767a87670d3d95

    • Size

      150KB

    • MD5

      9aa9cf034deaf46ad4714d3ddab92f9e

    • SHA1

      ed1ac2d3a7c099245c3b4756a50833bae6941e0b

    • SHA256

      1687bc0738560d9d615f5715ca377841fd87f86d6304201c66767a87670d3d95

    • SHA512

      e802caa7da6014ba7062a14504b96947a4bed82c046c222fee57931e76e74171d0edeae1a8e3efabf1b345936a4cc7371e343437ecd08a2a1009e20e662a6e85

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks