Overview

overview

10

Static

static

10

09cb2cdc7e...5a.exe

windows7_x64

10

09cb2cdc7e...5a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09cb2cdc7ef74e6fdc62ebdcfef6553307772353327068b796c407b521f0ef5a

  • Size

    150KB

  • Sample

    220212-lhcwxscccp

  • MD5

    f5641633208327ce7c3d8f1be3f86f30

  • SHA1

    22bfcce9f617d6b985d16f93bdbee764872fe869

  • SHA256

    09cb2cdc7ef74e6fdc62ebdcfef6553307772353327068b796c407b521f0ef5a

  • SHA512

    c883533e5579d6c1497bee984e2fea02129e5998f1222b1e334782d73dabc24829d17fd67858c5572a38b01ea79445e6609a6369bc222af18f7a41fe2e252e6e

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      09cb2cdc7ef74e6fdc62ebdcfef6553307772353327068b796c407b521f0ef5a

    • Size

      150KB

    • MD5

      f5641633208327ce7c3d8f1be3f86f30

    • SHA1

      22bfcce9f617d6b985d16f93bdbee764872fe869

    • SHA256

      09cb2cdc7ef74e6fdc62ebdcfef6553307772353327068b796c407b521f0ef5a

    • SHA512

      c883533e5579d6c1497bee984e2fea02129e5998f1222b1e334782d73dabc24829d17fd67858c5572a38b01ea79445e6609a6369bc222af18f7a41fe2e252e6e

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks