Overview

overview

10

Static

static

10

056c97f1e1...50.exe

windows7_x64

10

056c97f1e1...50.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    056c97f1e182de3322dcb4edb5bbc55ceb7bb67a0934e56db3b30d276ce80950

  • Size

    176KB

  • Sample

    220212-m58sjsdbgj

  • MD5

    51a435f97670104e19f8d81819d12d2b

  • SHA1

    037d7b50ba47d34b028e0db8cb6e9891e9f32b67

  • SHA256

    056c97f1e182de3322dcb4edb5bbc55ceb7bb67a0934e56db3b30d276ce80950

  • SHA512

    0702ec19fa6bcfbc4a13cb226c3185268dd03c69d6528318bd64f8b3a4a7abe66949601453dbaf86683e84332abbdba8df2a2718e9981694b9255c29a17b39f4

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      056c97f1e182de3322dcb4edb5bbc55ceb7bb67a0934e56db3b30d276ce80950

    • Size

      176KB

    • MD5

      51a435f97670104e19f8d81819d12d2b

    • SHA1

      037d7b50ba47d34b028e0db8cb6e9891e9f32b67

    • SHA256

      056c97f1e182de3322dcb4edb5bbc55ceb7bb67a0934e56db3b30d276ce80950

    • SHA512

      0702ec19fa6bcfbc4a13cb226c3185268dd03c69d6528318bd64f8b3a4a7abe66949601453dbaf86683e84332abbdba8df2a2718e9981694b9255c29a17b39f4

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks