Overview

overview

10

Static

static

10

0ff210133a...85.exe

windows7_x64

10

0ff210133a...85.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ff210133a0ced32e71ceae2736dbeebd4017578bb31f803443790c9a2fb6885

  • Size

    216KB

  • Sample

    220212-g71l3aafbn

  • MD5

    39d5f725284d06a60a5efc77be8c17ee

  • SHA1

    a493aec501a3d0e45fc625f6d230f82e2e26b4bb

  • SHA256

    0ff210133a0ced32e71ceae2736dbeebd4017578bb31f803443790c9a2fb6885

  • SHA512

    13b7c3eea0733a7e5b1ce93846f0651c49264eab51d5094f7a3a88ca1e5cdf34d026613e6aef191d759e9002db47ff1c285058662107f9ca12f693d442bdfaef

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0ff210133a0ced32e71ceae2736dbeebd4017578bb31f803443790c9a2fb6885

    • Size

      216KB

    • MD5

      39d5f725284d06a60a5efc77be8c17ee

    • SHA1

      a493aec501a3d0e45fc625f6d230f82e2e26b4bb

    • SHA256

      0ff210133a0ced32e71ceae2736dbeebd4017578bb31f803443790c9a2fb6885

    • SHA512

      13b7c3eea0733a7e5b1ce93846f0651c49264eab51d5094f7a3a88ca1e5cdf34d026613e6aef191d759e9002db47ff1c285058662107f9ca12f693d442bdfaef

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks