Overview

overview

10

Static

static

10

05ae2a071d...d5.exe

windows7_x64

10

05ae2a071d...d5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05ae2a071dcaabfee2f4ed9bdc6dedd9f9fdfbf1a4dc15120c4025bb12ddf7d5

  • Size

    92KB

  • Sample

    220212-m2ckyadbbm

  • MD5

    53ad0f12ad054219a6c12e39a4a48bf9

  • SHA1

    ef69914e5b1596e6e1d0967250550308bea54983

  • SHA256

    05ae2a071dcaabfee2f4ed9bdc6dedd9f9fdfbf1a4dc15120c4025bb12ddf7d5

  • SHA512

    694f8133d8d0729b9253ab561adf658327320e773db0d47e3b3b9614f60fda79d088d309e8cfc0d8f5ad395f9e59a38023cef1155d4da4e135d18d1cd8aa4701

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      05ae2a071dcaabfee2f4ed9bdc6dedd9f9fdfbf1a4dc15120c4025bb12ddf7d5

    • Size

      92KB

    • MD5

      53ad0f12ad054219a6c12e39a4a48bf9

    • SHA1

      ef69914e5b1596e6e1d0967250550308bea54983

    • SHA256

      05ae2a071dcaabfee2f4ed9bdc6dedd9f9fdfbf1a4dc15120c4025bb12ddf7d5

    • SHA512

      694f8133d8d0729b9253ab561adf658327320e773db0d47e3b3b9614f60fda79d088d309e8cfc0d8f5ad395f9e59a38023cef1155d4da4e135d18d1cd8aa4701

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks