Overview

overview

10

Static

static

10

057e946b48...e0.exe

windows7_x64

10

057e946b48...e0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    057e946b481892c3d207a3f13ebea74c08d6ada7a0faa54b28a84556f6d1cce0

  • Size

    150KB

  • Sample

    220212-m4rsmsdbep

  • MD5

    ab643e0500f2f14866e7341c7fbd5b1a

  • SHA1

    bc7772ac4fbb55ffa0a961a28da97619473f7fcf

  • SHA256

    057e946b481892c3d207a3f13ebea74c08d6ada7a0faa54b28a84556f6d1cce0

  • SHA512

    aac219f949a3806a28f8ff309a398b4e1f7a6013490bac731e84afb6118946f42e115bd5a4d09a1ba69ebabd8512e39b4e0062e3466540fc492d666e6b202ba7

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      057e946b481892c3d207a3f13ebea74c08d6ada7a0faa54b28a84556f6d1cce0

    • Size

      150KB

    • MD5

      ab643e0500f2f14866e7341c7fbd5b1a

    • SHA1

      bc7772ac4fbb55ffa0a961a28da97619473f7fcf

    • SHA256

      057e946b481892c3d207a3f13ebea74c08d6ada7a0faa54b28a84556f6d1cce0

    • SHA512

      aac219f949a3806a28f8ff309a398b4e1f7a6013490bac731e84afb6118946f42e115bd5a4d09a1ba69ebabd8512e39b4e0062e3466540fc492d666e6b202ba7

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks