Overview

overview

10

Static

static

10

03dc7e2724...60.exe

windows7_x64

10

03dc7e2724...60.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    03dc7e2724ff7832b133e83ea1a4353ea63222d07f63cc2f6e8ff42d56382a60

  • Size

    92KB

  • Sample

    220212-nrzhdsdeek

  • MD5

    01ecb63177e53560dab65efe57bfd257

  • SHA1

    cae7faa74e43205c3d2fbb6b2aeee869f8632690

  • SHA256

    03dc7e2724ff7832b133e83ea1a4353ea63222d07f63cc2f6e8ff42d56382a60

  • SHA512

    90989eb6c366df79bf31820378e282b25b79f387228cefd7c539d32c2118233127d993ba84d2ce0a663d991e32292e020780b8988cd62dc39ee7d15409de1126

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      03dc7e2724ff7832b133e83ea1a4353ea63222d07f63cc2f6e8ff42d56382a60

    • Size

      92KB

    • MD5

      01ecb63177e53560dab65efe57bfd257

    • SHA1

      cae7faa74e43205c3d2fbb6b2aeee869f8632690

    • SHA256

      03dc7e2724ff7832b133e83ea1a4353ea63222d07f63cc2f6e8ff42d56382a60

    • SHA512

      90989eb6c366df79bf31820378e282b25b79f387228cefd7c539d32c2118233127d993ba84d2ce0a663d991e32292e020780b8988cd62dc39ee7d15409de1126

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks