Overview

overview

10

Static

static

10

0acae2f4fd...dd.exe

windows7_x64

10

0acae2f4fd...dd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0acae2f4fdc58e4e89a5ec08bc674e52de33d5cf2e2039f313c472b5126b34dd

  • Size

    120KB

  • Sample

    220212-k5czrscafq

  • MD5

    43d416b54a7bbc7c120254879b308cbb

  • SHA1

    1da497ac6116fb330141166c87d49356ff7f688c

  • SHA256

    0acae2f4fdc58e4e89a5ec08bc674e52de33d5cf2e2039f313c472b5126b34dd

  • SHA512

    2bb63336bf5e8ef0581c73e99605e0eef0fd0c6bcf639283e0395373c75a6503fda201d2a5e058e3259b907f81e0f5149c0cf23a1f0cebb2a2ea7df180bb9535

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0acae2f4fdc58e4e89a5ec08bc674e52de33d5cf2e2039f313c472b5126b34dd

    • Size

      120KB

    • MD5

      43d416b54a7bbc7c120254879b308cbb

    • SHA1

      1da497ac6116fb330141166c87d49356ff7f688c

    • SHA256

      0acae2f4fdc58e4e89a5ec08bc674e52de33d5cf2e2039f313c472b5126b34dd

    • SHA512

      2bb63336bf5e8ef0581c73e99605e0eef0fd0c6bcf639283e0395373c75a6503fda201d2a5e058e3259b907f81e0f5149c0cf23a1f0cebb2a2ea7df180bb9535

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks