Overview

overview

10

Static

static

10

13d0a03d51...98.exe

windows7_x64

10

13d0a03d51...98.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13d0a03d511016861dd1a509031b3c1d8ba9abd6da50ce8dfc264ab22db6f998

  • Size

    151KB

  • Sample

    220212-fn9j7ahhaq

  • MD5

    cd42d1ed96b99ef5078d6a6873afdf48

  • SHA1

    07b8d9524b57bf36d6fc0e736331e3aa9346adc4

  • SHA256

    13d0a03d511016861dd1a509031b3c1d8ba9abd6da50ce8dfc264ab22db6f998

  • SHA512

    889528a8216210d11a8157a2459e89300f12fbb7664f1e85ddc132b1797066133a2215a29793be85b73c00546eddcc9fc259b0e1ba0c9ec57fce323642be458f

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      13d0a03d511016861dd1a509031b3c1d8ba9abd6da50ce8dfc264ab22db6f998

    • Size

      151KB

    • MD5

      cd42d1ed96b99ef5078d6a6873afdf48

    • SHA1

      07b8d9524b57bf36d6fc0e736331e3aa9346adc4

    • SHA256

      13d0a03d511016861dd1a509031b3c1d8ba9abd6da50ce8dfc264ab22db6f998

    • SHA512

      889528a8216210d11a8157a2459e89300f12fbb7664f1e85ddc132b1797066133a2215a29793be85b73c00546eddcc9fc259b0e1ba0c9ec57fce323642be458f

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks