Overview

overview

10

Static

static

10

0a10f5dce4...b1.exe

windows7_x64

10

0a10f5dce4...b1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a10f5dce40670fcfab0a7160d0edf9ce1ac968b0c0fbfa376c7a41ee78685b1

  • Size

    196KB

  • Sample

    220212-lek35acbgq

  • MD5

    70a226b0bb4c22642101a06e6fcd9766

  • SHA1

    962229d090a165c23dd529eda5882a87a5674985

  • SHA256

    0a10f5dce40670fcfab0a7160d0edf9ce1ac968b0c0fbfa376c7a41ee78685b1

  • SHA512

    f8b4d35dd090423bb08425b4ba5e1d4b2f1c975442903aaaf337685f4306b4e284b5c8f2f2f2e2c8b9e734abf0971777b5d86043695237bfde386135042ceb7d

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0a10f5dce40670fcfab0a7160d0edf9ce1ac968b0c0fbfa376c7a41ee78685b1

    • Size

      196KB

    • MD5

      70a226b0bb4c22642101a06e6fcd9766

    • SHA1

      962229d090a165c23dd529eda5882a87a5674985

    • SHA256

      0a10f5dce40670fcfab0a7160d0edf9ce1ac968b0c0fbfa376c7a41ee78685b1

    • SHA512

      f8b4d35dd090423bb08425b4ba5e1d4b2f1c975442903aaaf337685f4306b4e284b5c8f2f2f2e2c8b9e734abf0971777b5d86043695237bfde386135042ceb7d

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks