Overview

overview

10

Static

static

10

12d8a78b8c...b0.exe

windows7_x64

10

12d8a78b8c...b0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12d8a78b8c55cfdd83d9a28e01fb1250ea650ba17a5a6dbd4e79f6e16a0f3eb0

  • Size

    216KB

  • Sample

    220212-f3nahaaafl

  • MD5

    7e7f18ab921ddf04a11cdcc6aefd581e

  • SHA1

    0aa3dc262cf177cc8967e03652a043c3e35178ab

  • SHA256

    12d8a78b8c55cfdd83d9a28e01fb1250ea650ba17a5a6dbd4e79f6e16a0f3eb0

  • SHA512

    b50f07b95c1c7d4efee9e1fbb2b9cf032c2ad5314d131ab7ffc30ee92be93d460516ae310a5ab44a13716586bb30e2a891d0ebd6820bd29ab74b7749b55a9a1d

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      12d8a78b8c55cfdd83d9a28e01fb1250ea650ba17a5a6dbd4e79f6e16a0f3eb0

    • Size

      216KB

    • MD5

      7e7f18ab921ddf04a11cdcc6aefd581e

    • SHA1

      0aa3dc262cf177cc8967e03652a043c3e35178ab

    • SHA256

      12d8a78b8c55cfdd83d9a28e01fb1250ea650ba17a5a6dbd4e79f6e16a0f3eb0

    • SHA512

      b50f07b95c1c7d4efee9e1fbb2b9cf032c2ad5314d131ab7ffc30ee92be93d460516ae310a5ab44a13716586bb30e2a891d0ebd6820bd29ab74b7749b55a9a1d

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks