Overview

overview

10

Static

static

10

0579d654c2...fa.exe

windows7_x64

10

0579d654c2...fa.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0579d654c2a0c947305f7a3450a700695199a7c08aeed1684d2426d692af53fa

  • Size

    92KB

  • Sample

    220212-m436nsdber

  • MD5

    60ee144c198da66a10e94eef21250c87

  • SHA1

    8375fa39d89bd32f3f00203fc0a5a4f16a5651d1

  • SHA256

    0579d654c2a0c947305f7a3450a700695199a7c08aeed1684d2426d692af53fa

  • SHA512

    953b5fa3fa56a4fa26b5db328ca8a6483a57cd9d774d3b8c0a63239efb78f5dcfd35b6ad1bc7fc43794c4c9f51111d570426a508c1e6a0e1f6ed808c1b5b617c

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0579d654c2a0c947305f7a3450a700695199a7c08aeed1684d2426d692af53fa

    • Size

      92KB

    • MD5

      60ee144c198da66a10e94eef21250c87

    • SHA1

      8375fa39d89bd32f3f00203fc0a5a4f16a5651d1

    • SHA256

      0579d654c2a0c947305f7a3450a700695199a7c08aeed1684d2426d692af53fa

    • SHA512

      953b5fa3fa56a4fa26b5db328ca8a6483a57cd9d774d3b8c0a63239efb78f5dcfd35b6ad1bc7fc43794c4c9f51111d570426a508c1e6a0e1f6ed808c1b5b617c

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks