Overview

overview

10

Static

static

10

06addabcb9...79.exe

windows7_x64

10

06addabcb9...79.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    06addabcb99b3c2efc1bce9dccaac047fe2030028ca60887d51000b4f6f84f79

  • Size

    150KB

  • Sample

    220212-mn82zschgm

  • MD5

    c23c9ef779aae6a9e79a995d34ff9f1c

  • SHA1

    6846155913bd85ad47d84c676ba1bd28ca098671

  • SHA256

    06addabcb99b3c2efc1bce9dccaac047fe2030028ca60887d51000b4f6f84f79

  • SHA512

    5b772241c4b7d28983ea525d9ee2004f8ee67f22a25e67757bc81c00313414cd0a822c37a73c51685a0f3f4a40c294e07ab94d67aa4009a06baa94c40314c370

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      06addabcb99b3c2efc1bce9dccaac047fe2030028ca60887d51000b4f6f84f79

    • Size

      150KB

    • MD5

      c23c9ef779aae6a9e79a995d34ff9f1c

    • SHA1

      6846155913bd85ad47d84c676ba1bd28ca098671

    • SHA256

      06addabcb99b3c2efc1bce9dccaac047fe2030028ca60887d51000b4f6f84f79

    • SHA512

      5b772241c4b7d28983ea525d9ee2004f8ee67f22a25e67757bc81c00313414cd0a822c37a73c51685a0f3f4a40c294e07ab94d67aa4009a06baa94c40314c370

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks