Overview

overview

10

Static

static

10

14237b7657...fa.exe

windows7_x64

10

14237b7657...fa.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    14237b7657689c772a8842ee98d2fe7df324a04fff107faddcb6089a51712dfa

  • Size

    150KB

  • Sample

    220212-fh6akshgcl

  • MD5

    f110cba2f87e0aace9d42a29eaba6101

  • SHA1

    e8075fd0708ef5367d17ecdb6f0fff087c39a19d

  • SHA256

    14237b7657689c772a8842ee98d2fe7df324a04fff107faddcb6089a51712dfa

  • SHA512

    0eb61266c9ae5e4679e745c00ed89aeb3e52c5fec54d2e6907e43b18db8a9dcdd8417db2dfac1a58382bbf84ed021e5b8453b72a0a0b23e2ce02cde6c0c0e3c0

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      14237b7657689c772a8842ee98d2fe7df324a04fff107faddcb6089a51712dfa

    • Size

      150KB

    • MD5

      f110cba2f87e0aace9d42a29eaba6101

    • SHA1

      e8075fd0708ef5367d17ecdb6f0fff087c39a19d

    • SHA256

      14237b7657689c772a8842ee98d2fe7df324a04fff107faddcb6089a51712dfa

    • SHA512

      0eb61266c9ae5e4679e745c00ed89aeb3e52c5fec54d2e6907e43b18db8a9dcdd8417db2dfac1a58382bbf84ed021e5b8453b72a0a0b23e2ce02cde6c0c0e3c0

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks