Overview

overview

10

Static

static

10

0b27a1b2bb...2e.exe

windows7_x64

10

0b27a1b2bb...2e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e

  • Size

    176KB

  • Sample

    220212-kap1vabfdj

  • MD5

    23d0328e41f464e498749d6fe24c44e5

  • SHA1

    a2b7340d9c9b4196b123a278a8de963ba80835a4

  • SHA256

    0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e

  • SHA512

    6375a389e0dd16f040ccd2670f29a64a315b0cc4cfb1dc21a1dffa4d4e9d79ade1429f4c7ad077d119e04798af4c1b10ef2949c6b4a0ed3c6b27f5b11ed2d9ce

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e

    • Size

      176KB

    • MD5

      23d0328e41f464e498749d6fe24c44e5

    • SHA1

      a2b7340d9c9b4196b123a278a8de963ba80835a4

    • SHA256

      0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e

    • SHA512

      6375a389e0dd16f040ccd2670f29a64a315b0cc4cfb1dc21a1dffa4d4e9d79ade1429f4c7ad077d119e04798af4c1b10ef2949c6b4a0ed3c6b27f5b11ed2d9ce

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks