Overview

overview

10

Static

static

10

09e5b79d2c...33.exe

windows7_x64

10

09e5b79d2c...33.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09e5b79d2c0bd54d55c9b53779c817b0479d811eef512d2b8efb8d3cb6d88333

  • Size

    216KB

  • Sample

    220212-lf94msccbm

  • MD5

    99c98e88b064f33c2014dfb6c136ca66

  • SHA1

    4010616210d9a0c2965548ce1ca76fe5e6580265

  • SHA256

    09e5b79d2c0bd54d55c9b53779c817b0479d811eef512d2b8efb8d3cb6d88333

  • SHA512

    c159ee34a0d3eb8e5f969cddcf1649d50970fd44f0930bc65bb6855626dbe03d1fe3857f3de755356e309998c7f5363ad30b33d4d521b0092c35a8c7b1de5fb0

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      09e5b79d2c0bd54d55c9b53779c817b0479d811eef512d2b8efb8d3cb6d88333

    • Size

      216KB

    • MD5

      99c98e88b064f33c2014dfb6c136ca66

    • SHA1

      4010616210d9a0c2965548ce1ca76fe5e6580265

    • SHA256

      09e5b79d2c0bd54d55c9b53779c817b0479d811eef512d2b8efb8d3cb6d88333

    • SHA512

      c159ee34a0d3eb8e5f969cddcf1649d50970fd44f0930bc65bb6855626dbe03d1fe3857f3de755356e309998c7f5363ad30b33d4d521b0092c35a8c7b1de5fb0

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks