Overview

overview

10

Static

static

10

1000e73e10...ce.exe

windows7_x64

10

1000e73e10...ce.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1000e73e10e8d7e40be9ee1c5b6be98b1021bb8cc81dc918cd73b373b17f44ce

  • Size

    176KB

  • Sample

    220212-g7eplaafaq

  • MD5

    a87aaecdc10772206fbdfdc0d8a3a2b0

  • SHA1

    1c69ff6c9fdfd6a29db9203162f6a207131ee4aa

  • SHA256

    1000e73e10e8d7e40be9ee1c5b6be98b1021bb8cc81dc918cd73b373b17f44ce

  • SHA512

    ffbbc1b4839d610f4e8e1d6b2bf6cd7ba2278b0f0affce1f09ab7661ca1e6f107420314ce02cd9c2bd5aa06b394d625f99afcde2d6d6fc225a898e0b1d790482

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1000e73e10e8d7e40be9ee1c5b6be98b1021bb8cc81dc918cd73b373b17f44ce

    • Size

      176KB

    • MD5

      a87aaecdc10772206fbdfdc0d8a3a2b0

    • SHA1

      1c69ff6c9fdfd6a29db9203162f6a207131ee4aa

    • SHA256

      1000e73e10e8d7e40be9ee1c5b6be98b1021bb8cc81dc918cd73b373b17f44ce

    • SHA512

      ffbbc1b4839d610f4e8e1d6b2bf6cd7ba2278b0f0affce1f09ab7661ca1e6f107420314ce02cd9c2bd5aa06b394d625f99afcde2d6d6fc225a898e0b1d790482

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks