Overview

overview

10

Static

static

10

1387d1d2c3...7e.exe

windows7_x64

10

1387d1d2c3...7e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1387d1d2c3e529ca8b95c752e0e00be9f379ddf9d8f2864b6bcf33ea00da527e

  • Size

    188KB

  • Sample

    220212-ftjkyshhfk

  • MD5

    bfcdc5bfa4861ff40a2b67bf97679b85

  • SHA1

    69227823fc080a49a3e043758d1bd77a8abf2e8b

  • SHA256

    1387d1d2c3e529ca8b95c752e0e00be9f379ddf9d8f2864b6bcf33ea00da527e

  • SHA512

    8b2d4210e519d22822baa4437f0b6336abdf4563cc1e6a570463b91c903d14b5310d4865c9c6687afd5f8e0c42c468814c1efd7a1caf1242013eb99de02e9412

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1387d1d2c3e529ca8b95c752e0e00be9f379ddf9d8f2864b6bcf33ea00da527e

    • Size

      188KB

    • MD5

      bfcdc5bfa4861ff40a2b67bf97679b85

    • SHA1

      69227823fc080a49a3e043758d1bd77a8abf2e8b

    • SHA256

      1387d1d2c3e529ca8b95c752e0e00be9f379ddf9d8f2864b6bcf33ea00da527e

    • SHA512

      8b2d4210e519d22822baa4437f0b6336abdf4563cc1e6a570463b91c903d14b5310d4865c9c6687afd5f8e0c42c468814c1efd7a1caf1242013eb99de02e9412

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks