Overview

overview

10

Static

static

10

101a60d31b...e5.exe

windows7_x64

10

101a60d31b...e5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    101a60d31b6d4e4c2444fa649ae3f45198d548d34c816a666b00eb060961a6e5

  • Size

    150KB

  • Sample

    220212-g53cwaaehp

  • MD5

    1781e2c8a95f48813104dd3660d9f0b6

  • SHA1

    f56a7d4a3c85bcaae2264c4eb3d76d8197d06ac9

  • SHA256

    101a60d31b6d4e4c2444fa649ae3f45198d548d34c816a666b00eb060961a6e5

  • SHA512

    547e25ffc4c84d9003f140eca436b5a25c9faaa33eb8668ba246d2f611c57b180e8f0b0f077a4c636d894fb857730c3fe13800831c41b78095abf2d6a84b4814

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      101a60d31b6d4e4c2444fa649ae3f45198d548d34c816a666b00eb060961a6e5

    • Size

      150KB

    • MD5

      1781e2c8a95f48813104dd3660d9f0b6

    • SHA1

      f56a7d4a3c85bcaae2264c4eb3d76d8197d06ac9

    • SHA256

      101a60d31b6d4e4c2444fa649ae3f45198d548d34c816a666b00eb060961a6e5

    • SHA512

      547e25ffc4c84d9003f140eca436b5a25c9faaa33eb8668ba246d2f611c57b180e8f0b0f077a4c636d894fb857730c3fe13800831c41b78095abf2d6a84b4814

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks