Overview

overview

10

Static

static

10

07d68067fa...ff.exe

windows7_x64

10

07d68067fa...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff

  • Size

    92KB

  • Sample

    220212-l83v2acffj

  • MD5

    cbbaeafbd00c14a5a59dd3f605fbeb10

  • SHA1

    b7cabd76d3ff3204606bd42386412c035bb792ba

  • SHA256

    07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff

  • SHA512

    d20e6fdcd804425fa427cad676312b80b57db735a1c905de87a78a4726a2fe4ec5e2006cdc9243ed907d10a4b522a8d2c39b65b372c98f77196368a3f3c50b42

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff

    • Size

      92KB

    • MD5

      cbbaeafbd00c14a5a59dd3f605fbeb10

    • SHA1

      b7cabd76d3ff3204606bd42386412c035bb792ba

    • SHA256

      07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff

    • SHA512

      d20e6fdcd804425fa427cad676312b80b57db735a1c905de87a78a4726a2fe4ec5e2006cdc9243ed907d10a4b522a8d2c39b65b372c98f77196368a3f3c50b42

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks