Overview

overview

10

Static

static

10

0ee228725e...d2.exe

windows7_x64

10

0ee228725e...d2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ee228725e86209e46fbe6a6c2a81d0b8ab9f27124b805611418b0fa9d480ed2

  • Size

    92KB

  • Sample

    220212-hslp2aaghp

  • MD5

    6c7a2e30d1f5c626009aa06d60b9e4d7

  • SHA1

    fea71e42fa34ccfada3d915a43c63bc2e4e7d73d

  • SHA256

    0ee228725e86209e46fbe6a6c2a81d0b8ab9f27124b805611418b0fa9d480ed2

  • SHA512

    5fa71396e4d0e3da802c1ec3e5220dd5a7015889bc45f0c026cc853020f8ee1ec2f6c1590d354b0f7038da732a73a22f4ebcd5af06cdd1dcb4d951b875703f5a

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0ee228725e86209e46fbe6a6c2a81d0b8ab9f27124b805611418b0fa9d480ed2

    • Size

      92KB

    • MD5

      6c7a2e30d1f5c626009aa06d60b9e4d7

    • SHA1

      fea71e42fa34ccfada3d915a43c63bc2e4e7d73d

    • SHA256

      0ee228725e86209e46fbe6a6c2a81d0b8ab9f27124b805611418b0fa9d480ed2

    • SHA512

      5fa71396e4d0e3da802c1ec3e5220dd5a7015889bc45f0c026cc853020f8ee1ec2f6c1590d354b0f7038da732a73a22f4ebcd5af06cdd1dcb4d951b875703f5a

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks