Overview

overview

10

Static

static

10

0c9577428e...e2.exe

windows7_x64

10

0c9577428e...e2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c9577428e8309f347c60ec09ffd783d9ca61893a8b7fcd6b17867a4596349e2

  • Size

    188KB

  • Sample

    220212-jn15labcgr

  • MD5

    b5fccde26da0806e4ff89bfd58ad2932

  • SHA1

    0476ba5a48f259384ffaec3d057cabcf29653add

  • SHA256

    0c9577428e8309f347c60ec09ffd783d9ca61893a8b7fcd6b17867a4596349e2

  • SHA512

    492601f6147a02f62062017e29dbbc31d3c96fc255aeb09fd525ccf32db7c7408a91cf4ee55d8e1c73c4899533954f11f231fb7fa21306ef99ae4da4a8869389

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0c9577428e8309f347c60ec09ffd783d9ca61893a8b7fcd6b17867a4596349e2

    • Size

      188KB

    • MD5

      b5fccde26da0806e4ff89bfd58ad2932

    • SHA1

      0476ba5a48f259384ffaec3d057cabcf29653add

    • SHA256

      0c9577428e8309f347c60ec09ffd783d9ca61893a8b7fcd6b17867a4596349e2

    • SHA512

      492601f6147a02f62062017e29dbbc31d3c96fc255aeb09fd525ccf32db7c7408a91cf4ee55d8e1c73c4899533954f11f231fb7fa21306ef99ae4da4a8869389

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks