Overview

overview

10

Static

static

10

06dfcc86da...62.exe

windows7_x64

10

06dfcc86da...62.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06dfcc86da18c2d8d28aa64a4e3c79ef90de09570e907cb6fa66a29e9cbb1662

  • Size

    216KB

  • Sample

    220212-mk4m4achdk

  • MD5

    a97f607142e1be5928046b7af1caf789

  • SHA1

    66e8fbfae39dfbbbd12c7d4530d0d935746f9033

  • SHA256

    06dfcc86da18c2d8d28aa64a4e3c79ef90de09570e907cb6fa66a29e9cbb1662

  • SHA512

    94f8af431c52c91f0a70a7c8ce9ba59d68b1e4456746398d3ab71200ba0c179e54237c2190cd2146b22abd04ffc430a56f9fa5cdfa5736c20fa44effb64e02e3

Score
10/10
sakulapersistenceratsuricatatrojanupx

Malware Config

Targets

    • Target

      06dfcc86da18c2d8d28aa64a4e3c79ef90de09570e907cb6fa66a29e9cbb1662

    • Size

      216KB

    • MD5

      a97f607142e1be5928046b7af1caf789

    • SHA1

      66e8fbfae39dfbbbd12c7d4530d0d935746f9033

    • SHA256

      06dfcc86da18c2d8d28aa64a4e3c79ef90de09570e907cb6fa66a29e9cbb1662

    • SHA512

      94f8af431c52c91f0a70a7c8ce9ba59d68b1e4456746398d3ab71200ba0c179e54237c2190cd2146b22abd04ffc430a56f9fa5cdfa5736c20fa44effb64e02e3

    Score
    10/10
    sakulapersistenceratsuricatatrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks