Overview

overview

10

Static

static

10

1455e88c24...a0.exe

windows7_x64

10

1455e88c24...a0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1455e88c24c9e19b808727bdf34e912b02541b467cd87eae1cfd4eeccc7a17a0

  • Size

    150KB

  • Sample

    220212-ffls6ahfhr

  • MD5

    e1762451232f83828939e62b29b5d317

  • SHA1

    a1b5e480dacc78969b770e1184351b4c46713b09

  • SHA256

    1455e88c24c9e19b808727bdf34e912b02541b467cd87eae1cfd4eeccc7a17a0

  • SHA512

    dfa909cfdee7554b9e58ffa2055763c43fcb2c023bfa727cecf65ed2364afff16e55ac1fe4eb1bf83f1ebe6720d8b9960ec1d0e50569239b79dea994b4929934

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1455e88c24c9e19b808727bdf34e912b02541b467cd87eae1cfd4eeccc7a17a0

    • Size

      150KB

    • MD5

      e1762451232f83828939e62b29b5d317

    • SHA1

      a1b5e480dacc78969b770e1184351b4c46713b09

    • SHA256

      1455e88c24c9e19b808727bdf34e912b02541b467cd87eae1cfd4eeccc7a17a0

    • SHA512

      dfa909cfdee7554b9e58ffa2055763c43fcb2c023bfa727cecf65ed2364afff16e55ac1fe4eb1bf83f1ebe6720d8b9960ec1d0e50569239b79dea994b4929934

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks