Overview

overview

10

Static

static

10

1235f0d356...dc.exe

windows7_x64

10

1235f0d356...dc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1235f0d35686b31972ebb629be918bcb4f2178e3c896825dd65fc5d6325b15dc

  • Size

    92KB

  • Sample

    220212-gayq7sabfj

  • MD5

    1bf526548688d71ac26e41d91d89f8c1

  • SHA1

    128b5b2fde6377c26a60da99e0a7bcb5ba8def60

  • SHA256

    1235f0d35686b31972ebb629be918bcb4f2178e3c896825dd65fc5d6325b15dc

  • SHA512

    c80d0b529a5dae39f913fa19892b6e9fb3073405704cb4d81326b3a8d8ba01ef040259fcd378b62ff69cc79a5c612c5c48cd0e422cf10c896af380ed5e81f8a2

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      1235f0d35686b31972ebb629be918bcb4f2178e3c896825dd65fc5d6325b15dc

    • Size

      92KB

    • MD5

      1bf526548688d71ac26e41d91d89f8c1

    • SHA1

      128b5b2fde6377c26a60da99e0a7bcb5ba8def60

    • SHA256

      1235f0d35686b31972ebb629be918bcb4f2178e3c896825dd65fc5d6325b15dc

    • SHA512

      c80d0b529a5dae39f913fa19892b6e9fb3073405704cb4d81326b3a8d8ba01ef040259fcd378b62ff69cc79a5c612c5c48cd0e422cf10c896af380ed5e81f8a2

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks