Overview

overview

10

Static

static

10

12dbf7edc2...72.exe

windows7_x64

10

12dbf7edc2...72.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12dbf7edc260170e13f62576e5cd52e71724af6a11f1c9914504f3a314bfce72

  • Size

    212KB

  • Sample

    220212-f3jbjsaafk

  • MD5

    90cdb47cfbf4f43ca63db6ba94f92bb2

  • SHA1

    5ec6c83edd3dae7b03234c42afc9b8d48efd5b99

  • SHA256

    12dbf7edc260170e13f62576e5cd52e71724af6a11f1c9914504f3a314bfce72

  • SHA512

    0c53d3ca9cd22d920e62b1533a06cd650b21e0b83f76b1701ad0dea9504412346df20936e9fd90edc0f9e353a46a0710a05a3c237977c7181c064484f6b1a295

Score
10/10
sakulapersistenceratsuricatatrojanupx

Malware Config

Targets

    • Target

      12dbf7edc260170e13f62576e5cd52e71724af6a11f1c9914504f3a314bfce72

    • Size

      212KB

    • MD5

      90cdb47cfbf4f43ca63db6ba94f92bb2

    • SHA1

      5ec6c83edd3dae7b03234c42afc9b8d48efd5b99

    • SHA256

      12dbf7edc260170e13f62576e5cd52e71724af6a11f1c9914504f3a314bfce72

    • SHA512

      0c53d3ca9cd22d920e62b1533a06cd650b21e0b83f76b1701ad0dea9504412346df20936e9fd90edc0f9e353a46a0710a05a3c237977c7181c064484f6b1a295

    Score
    10/10
    sakulapersistenceratsuricatatrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks