Overview

overview

10

Static

static

10

1586703f8a...66.exe

windows7_x64

10

1586703f8a...66.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1586703f8a2624fb562863f6e6539b5fa647a0e0858ce131cb49eb943ac2b966

  • Size

    89KB

  • Sample

    220212-exln2sheak

  • MD5

    77c19572915d6949592e2ec5614fb8b4

  • SHA1

    2857e956fe9d32a682289966cfe3c4a8445f718f

  • SHA256

    1586703f8a2624fb562863f6e6539b5fa647a0e0858ce131cb49eb943ac2b966

  • SHA512

    b67a35c5ad85ba939b948de34e2a2a4c016b049bc64db1a8e350ce375de5e75f6bac708282af38d4b8029ea8ea5951fbf256494a7b2b861a96753b0560f9f254

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1586703f8a2624fb562863f6e6539b5fa647a0e0858ce131cb49eb943ac2b966

    • Size

      89KB

    • MD5

      77c19572915d6949592e2ec5614fb8b4

    • SHA1

      2857e956fe9d32a682289966cfe3c4a8445f718f

    • SHA256

      1586703f8a2624fb562863f6e6539b5fa647a0e0858ce131cb49eb943ac2b966

    • SHA512

      b67a35c5ad85ba939b948de34e2a2a4c016b049bc64db1a8e350ce375de5e75f6bac708282af38d4b8029ea8ea5951fbf256494a7b2b861a96753b0560f9f254

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks