Overview

overview

10

Static

static

10

0923d4c527...80.exe

windows7_x64

10

0923d4c527...80.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0923d4c5278e00f3526acbf85eea45251e0fd11593ba47e45d459c3d57f15480

  • Size

    168KB

  • Sample

    220212-lq4dvacddk

  • MD5

    ef90eb01b75e91e9e84682e225d63622

  • SHA1

    ae32de0ff323f15b0ff2b044ef08c185e3d821ea

  • SHA256

    0923d4c5278e00f3526acbf85eea45251e0fd11593ba47e45d459c3d57f15480

  • SHA512

    2cc0a20d61fb55c704f401bf235406b2ad55971529721842dfd6203365caf443ff4509456752eba2b6541fa78cfecae49a292a5262da981ee7d384dcee37d8e1

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0923d4c5278e00f3526acbf85eea45251e0fd11593ba47e45d459c3d57f15480

    • Size

      168KB

    • MD5

      ef90eb01b75e91e9e84682e225d63622

    • SHA1

      ae32de0ff323f15b0ff2b044ef08c185e3d821ea

    • SHA256

      0923d4c5278e00f3526acbf85eea45251e0fd11593ba47e45d459c3d57f15480

    • SHA512

      2cc0a20d61fb55c704f401bf235406b2ad55971529721842dfd6203365caf443ff4509456752eba2b6541fa78cfecae49a292a5262da981ee7d384dcee37d8e1

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks