Overview

overview

10

Static

static

10

03f1f2b57d...f6.exe

windows7_x64

10

03f1f2b57d...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03f1f2b57df6d72288ff81057ccb8aa6aa0c15b56848aa6f6eec329ee2466af6

  • Size

    89KB

  • Sample

    220212-nq1ztsdedl

  • MD5

    dc079fb7a434fc846f689888c2a08961

  • SHA1

    054b29070397c46350d04b4c1371767fd72f14ec

  • SHA256

    03f1f2b57df6d72288ff81057ccb8aa6aa0c15b56848aa6f6eec329ee2466af6

  • SHA512

    5dbe78d006d9a4fff7cf5f8a053827d17157064921a2368cc2f5fd7aa703018ef09489f92be36c2e377dac044a58f29f88490755a87eb5f4c0513f20dc91c5a0

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      03f1f2b57df6d72288ff81057ccb8aa6aa0c15b56848aa6f6eec329ee2466af6

    • Size

      89KB

    • MD5

      dc079fb7a434fc846f689888c2a08961

    • SHA1

      054b29070397c46350d04b4c1371767fd72f14ec

    • SHA256

      03f1f2b57df6d72288ff81057ccb8aa6aa0c15b56848aa6f6eec329ee2466af6

    • SHA512

      5dbe78d006d9a4fff7cf5f8a053827d17157064921a2368cc2f5fd7aa703018ef09489f92be36c2e377dac044a58f29f88490755a87eb5f4c0513f20dc91c5a0

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks