Overview

overview

10

Static

static

10

1460078f1a...16.exe

windows7_x64

10

1460078f1a...16.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1460078f1a6875972f9cae2e98f532722c53b8648f4732032242651a5d167f16

  • Size

    176KB

  • Sample

    220212-fe56eahfhk

  • MD5

    bdf1e255ef4bf1e21100551fd49bf028

  • SHA1

    6d9274cd78a14d730b1ad4b06dd9add50f285be9

  • SHA256

    1460078f1a6875972f9cae2e98f532722c53b8648f4732032242651a5d167f16

  • SHA512

    2f862c60803b8b161f92a2bebce3a3f33da015ce634bc8ef470dab0f117d4142885567b1ac87658ddc8b335dc60e26fe477bbdec47824a13a48c2562062c2153

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1460078f1a6875972f9cae2e98f532722c53b8648f4732032242651a5d167f16

    • Size

      176KB

    • MD5

      bdf1e255ef4bf1e21100551fd49bf028

    • SHA1

      6d9274cd78a14d730b1ad4b06dd9add50f285be9

    • SHA256

      1460078f1a6875972f9cae2e98f532722c53b8648f4732032242651a5d167f16

    • SHA512

      2f862c60803b8b161f92a2bebce3a3f33da015ce634bc8ef470dab0f117d4142885567b1ac87658ddc8b335dc60e26fe477bbdec47824a13a48c2562062c2153

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks