Overview

overview

10

Static

static

116b4a0464...41.exe

windows7_x64

10

116b4a0464...41.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    116b4a0464f9c9f0fa1bf876ff3abe605346b9fddee0af706ca045ca5260f441

  • Size

    41KB

  • Sample

    220212-glahraacgj

  • MD5

    7686a9cd8a51078a5fc263f272af801b

  • SHA1

    1372a8392c3990ea2d8a2327879a9847541ae6bf

  • SHA256

    116b4a0464f9c9f0fa1bf876ff3abe605346b9fddee0af706ca045ca5260f441

  • SHA512

    d35a7a2fc0ffca516227b034709185f81d787701f52ccca6d77cf0e361e5b4a18a077708eef4ae7e41720a074b13b117b383c96c914a73ec5a710e5cc7c81ea8

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      116b4a0464f9c9f0fa1bf876ff3abe605346b9fddee0af706ca045ca5260f441

    • Size

      41KB

    • MD5

      7686a9cd8a51078a5fc263f272af801b

    • SHA1

      1372a8392c3990ea2d8a2327879a9847541ae6bf

    • SHA256

      116b4a0464f9c9f0fa1bf876ff3abe605346b9fddee0af706ca045ca5260f441

    • SHA512

      d35a7a2fc0ffca516227b034709185f81d787701f52ccca6d77cf0e361e5b4a18a077708eef4ae7e41720a074b13b117b383c96c914a73ec5a710e5cc7c81ea8

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks