Overview

overview

10

Static

static

10

0e2513a4d5...18.exe

windows7_x64

10

0e2513a4d5...18.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e2513a4d599c4884cf8f7399d43dc19c8961a5016ff3e0b3f3f74977667f018

  • Size

    92KB

  • Sample

    220212-h248qsbaam

  • MD5

    507d2866de11278a5b58c6e660679834

  • SHA1

    727baaf1dea8cdbd7c1b8f365b0f80284acc0707

  • SHA256

    0e2513a4d599c4884cf8f7399d43dc19c8961a5016ff3e0b3f3f74977667f018

  • SHA512

    899e7c946f087ec7a393a8194e9fd907c3124ba7205d8cf60a116b461d6e5a2dee995ce4c93177ffb08aa9a70ee649aad91f513c70153fbef098a2f923c94fdd

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0e2513a4d599c4884cf8f7399d43dc19c8961a5016ff3e0b3f3f74977667f018

    • Size

      92KB

    • MD5

      507d2866de11278a5b58c6e660679834

    • SHA1

      727baaf1dea8cdbd7c1b8f365b0f80284acc0707

    • SHA256

      0e2513a4d599c4884cf8f7399d43dc19c8961a5016ff3e0b3f3f74977667f018

    • SHA512

      899e7c946f087ec7a393a8194e9fd907c3124ba7205d8cf60a116b461d6e5a2dee995ce4c93177ffb08aa9a70ee649aad91f513c70153fbef098a2f923c94fdd

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks