Overview

overview

10

Static

static

10

079227deb2...1c.exe

windows7_x64

10

079227deb2...1c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079227deb2e3306938231c84ee730c6806831e711caa2247e7905b6b7cf6fb1c

  • Size

    90KB

  • Sample

    220212-mc7d1scgbn

  • MD5

    8363690abc4e3e53e1da6b5bed98dcaf

  • SHA1

    9bc6cc6ad69f7f5bf7c00b36e9307451d13450c7

  • SHA256

    079227deb2e3306938231c84ee730c6806831e711caa2247e7905b6b7cf6fb1c

  • SHA512

    1ae3cca89e2c36de4741dfc3e231f87c2886df691e608475e217abac6a1f67ba787d3de0e3a4342a53ba869c8f5337f5182abff8bdf30c97f36b573696a05f80

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      079227deb2e3306938231c84ee730c6806831e711caa2247e7905b6b7cf6fb1c

    • Size

      90KB

    • MD5

      8363690abc4e3e53e1da6b5bed98dcaf

    • SHA1

      9bc6cc6ad69f7f5bf7c00b36e9307451d13450c7

    • SHA256

      079227deb2e3306938231c84ee730c6806831e711caa2247e7905b6b7cf6fb1c

    • SHA512

      1ae3cca89e2c36de4741dfc3e231f87c2886df691e608475e217abac6a1f67ba787d3de0e3a4342a53ba869c8f5337f5182abff8bdf30c97f36b573696a05f80

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks