Overview

overview

10

Static

static

10

03e3bda68f...51.exe

windows7_x64

10

03e3bda68f...51.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03e3bda68fcd175c0975bcbe791613307bdf9e8db6198920f1314e95366b3a51

  • Size

    150KB

  • Sample

    220212-nrlljadedp

  • MD5

    5ae588ca90c2a6727a6f8b5f2cab3ee9

  • SHA1

    e82167a1b68041ceedff0f03ec78d836e09cd81a

  • SHA256

    03e3bda68fcd175c0975bcbe791613307bdf9e8db6198920f1314e95366b3a51

  • SHA512

    20a1b34cc896206918d50f0cdca97d2200024b3d97c0ae29ba374396201b26194daa7ed25e89dcfc103f5f5a61339acd3d17cab52e07034c519d3fd9ab805c30

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      03e3bda68fcd175c0975bcbe791613307bdf9e8db6198920f1314e95366b3a51

    • Size

      150KB

    • MD5

      5ae588ca90c2a6727a6f8b5f2cab3ee9

    • SHA1

      e82167a1b68041ceedff0f03ec78d836e09cd81a

    • SHA256

      03e3bda68fcd175c0975bcbe791613307bdf9e8db6198920f1314e95366b3a51

    • SHA512

      20a1b34cc896206918d50f0cdca97d2200024b3d97c0ae29ba374396201b26194daa7ed25e89dcfc103f5f5a61339acd3d17cab52e07034c519d3fd9ab805c30

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks