Overview

overview

10

Static

static

10

04d3d9eb6e...47.exe

windows7_x64

10

04d3d9eb6e...47.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04d3d9eb6e755a98acf82af1b0079c8530b437210da0184bf7158f2880c6e447

  • Size

    150KB

  • Sample

    220212-nc4hssdcfn

  • MD5

    3f19eaee8de2faf5e94c4901a03e4e00

  • SHA1

    865ce00457eb2b4e4fe6efe0e7d256f5e003b652

  • SHA256

    04d3d9eb6e755a98acf82af1b0079c8530b437210da0184bf7158f2880c6e447

  • SHA512

    afca62af017bd99fd47dcdb4c179322161010b24f960fdca811fdf3e4e1f03111d198d23d5f99730c51486e8e8e7f5c976a191f5e55a4fe224e44cb5dd41aecb

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      04d3d9eb6e755a98acf82af1b0079c8530b437210da0184bf7158f2880c6e447

    • Size

      150KB

    • MD5

      3f19eaee8de2faf5e94c4901a03e4e00

    • SHA1

      865ce00457eb2b4e4fe6efe0e7d256f5e003b652

    • SHA256

      04d3d9eb6e755a98acf82af1b0079c8530b437210da0184bf7158f2880c6e447

    • SHA512

      afca62af017bd99fd47dcdb4c179322161010b24f960fdca811fdf3e4e1f03111d198d23d5f99730c51486e8e8e7f5c976a191f5e55a4fe224e44cb5dd41aecb

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks