Overview

overview

10

Static

static

10

1493f415d2...c7.exe

windows7_x64

10

1493f415d2...c7.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1493f415d215f12eb7a4988ad1764df80a2b54e0d243b82d7ff8a966c45220c7

  • Size

    176KB

  • Sample

    220212-fdpr2ahffm

  • MD5

    27593b6684d52b99139abd6702ba8c48

  • SHA1

    baa9c32fb54f2545b33864de3c71d726f10352f1

  • SHA256

    1493f415d215f12eb7a4988ad1764df80a2b54e0d243b82d7ff8a966c45220c7

  • SHA512

    c89ff158a41fcfd36b67dee009bedb25092ba3142fcd43fdeeaae3209e8ee6b8c5cc50cb3b67d96053b60a408d74c144d85ffbff5c31ca8c20d4cf2c79833f42

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1493f415d215f12eb7a4988ad1764df80a2b54e0d243b82d7ff8a966c45220c7

    • Size

      176KB

    • MD5

      27593b6684d52b99139abd6702ba8c48

    • SHA1

      baa9c32fb54f2545b33864de3c71d726f10352f1

    • SHA256

      1493f415d215f12eb7a4988ad1764df80a2b54e0d243b82d7ff8a966c45220c7

    • SHA512

      c89ff158a41fcfd36b67dee009bedb25092ba3142fcd43fdeeaae3209e8ee6b8c5cc50cb3b67d96053b60a408d74c144d85ffbff5c31ca8c20d4cf2c79833f42

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks