Overview

overview

10

Static

static

10

13fabf8357...9f.exe

windows7_x64

10

13fabf8357...9f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13fabf835778305695c523bbd0faaf76e950c5fa99336734518f4ecb117e4e9f

  • Size

    92KB

  • Sample

    220212-fk8tgshgfj

  • MD5

    99999f8f9ad28f802df2fa518cd3d0ad

  • SHA1

    d872790eec0a76b201271e42d3f192039f67b617

  • SHA256

    13fabf835778305695c523bbd0faaf76e950c5fa99336734518f4ecb117e4e9f

  • SHA512

    7249a115f2e95feb4606d4f2ee5c1b913364c6f7391cd352d5e75b11884b582754e38421efdd37b1bad38d53c0f28382adedebc0d4ab796ffa2463d8a8409c3e

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      13fabf835778305695c523bbd0faaf76e950c5fa99336734518f4ecb117e4e9f

    • Size

      92KB

    • MD5

      99999f8f9ad28f802df2fa518cd3d0ad

    • SHA1

      d872790eec0a76b201271e42d3f192039f67b617

    • SHA256

      13fabf835778305695c523bbd0faaf76e950c5fa99336734518f4ecb117e4e9f

    • SHA512

      7249a115f2e95feb4606d4f2ee5c1b913364c6f7391cd352d5e75b11884b582754e38421efdd37b1bad38d53c0f28382adedebc0d4ab796ffa2463d8a8409c3e

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks