Overview

overview

10

Static

static

10

072af0028a...cc.exe

windows7_x64

10

072af0028a...cc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    072af0028a439fb2090e39aa3319ec8be72a294c4e3dfd69c75df0c290d218cc

  • Size

    216KB

  • Sample

    220212-mhax1acgfq

  • MD5

    c02a2f74ac3cf6d83c491519f2940181

  • SHA1

    866c89aacfa8afa8bff64fb12774ece4fe869c42

  • SHA256

    072af0028a439fb2090e39aa3319ec8be72a294c4e3dfd69c75df0c290d218cc

  • SHA512

    f6b86997e9b4849e1f6aa850bf3ad4b0ab787cc2e3b3081a0528ac135311af17e3e4d3ee28baf0acab53ad3f69c53d4bcb4e12b2df66517ad7b05f7dc3944b44

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      072af0028a439fb2090e39aa3319ec8be72a294c4e3dfd69c75df0c290d218cc

    • Size

      216KB

    • MD5

      c02a2f74ac3cf6d83c491519f2940181

    • SHA1

      866c89aacfa8afa8bff64fb12774ece4fe869c42

    • SHA256

      072af0028a439fb2090e39aa3319ec8be72a294c4e3dfd69c75df0c290d218cc

    • SHA512

      f6b86997e9b4849e1f6aa850bf3ad4b0ab787cc2e3b3081a0528ac135311af17e3e4d3ee28baf0acab53ad3f69c53d4bcb4e12b2df66517ad7b05f7dc3944b44

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks