Overview

overview

10

Static

static

10

111d5a185a...5d.exe

windows7_x64

10

111d5a185a...5d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    111d5a185a7e0b10ccbe4f67179fc03a1d18abda039297dd3aa29cfa0cff665d

  • Size

    116KB

  • Sample

    220212-gq2sssadcm

  • MD5

    dbcc2e09b92133870550bf10ffc6a7ac

  • SHA1

    ac0a3bfb2e4fe1142f8f49c6c2bbea3a91d55db1

  • SHA256

    111d5a185a7e0b10ccbe4f67179fc03a1d18abda039297dd3aa29cfa0cff665d

  • SHA512

    1a0926ae843b4d6479bb03766cb30b5863f9f0cc2a4cf50f4c5141468319b9b56967306cb4ef48e2bf7ce2552da24c1d38e20f446b37da5824dbb2b54f05748e

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      111d5a185a7e0b10ccbe4f67179fc03a1d18abda039297dd3aa29cfa0cff665d

    • Size

      116KB

    • MD5

      dbcc2e09b92133870550bf10ffc6a7ac

    • SHA1

      ac0a3bfb2e4fe1142f8f49c6c2bbea3a91d55db1

    • SHA256

      111d5a185a7e0b10ccbe4f67179fc03a1d18abda039297dd3aa29cfa0cff665d

    • SHA512

      1a0926ae843b4d6479bb03766cb30b5863f9f0cc2a4cf50f4c5141468319b9b56967306cb4ef48e2bf7ce2552da24c1d38e20f446b37da5824dbb2b54f05748e

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks