Overview

overview

10

Static

static

10

11cbc586e7...3c.exe

windows7_x64

10

11cbc586e7...3c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11cbc586e722fa2cdec200bc535e43b261da38c6a569ce46e4bd5f0b5b21223c

  • Size

    89KB

  • Sample

    220212-gfns7aacck

  • MD5

    3d0a4c31355525d6faa9d182320b4174

  • SHA1

    bf98b167871a1aa34d98fa12a69793b8f3fd087a

  • SHA256

    11cbc586e722fa2cdec200bc535e43b261da38c6a569ce46e4bd5f0b5b21223c

  • SHA512

    053920ebb39130baf627caff21a305e1e9b82d5f7de134b0a69813a08ae2bb3bd274e481888ae0561f825740d3acaff3649827a66c8080ce55829a5a523c20f5

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      11cbc586e722fa2cdec200bc535e43b261da38c6a569ce46e4bd5f0b5b21223c

    • Size

      89KB

    • MD5

      3d0a4c31355525d6faa9d182320b4174

    • SHA1

      bf98b167871a1aa34d98fa12a69793b8f3fd087a

    • SHA256

      11cbc586e722fa2cdec200bc535e43b261da38c6a569ce46e4bd5f0b5b21223c

    • SHA512

      053920ebb39130baf627caff21a305e1e9b82d5f7de134b0a69813a08ae2bb3bd274e481888ae0561f825740d3acaff3649827a66c8080ce55829a5a523c20f5

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks