Overview

overview

10

Static

static

10

0391d5f805...03.exe

windows7_x64

10

0391d5f805...03.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0391d5f8055b390f303b4ee164414c09206a558ab6ee99b844126f20877c8c03

  • Size

    150KB

  • Sample

    220212-nv2rxsdehm

  • MD5

    fa5cc5f6b2591ba50d8b3d63d36b94ef

  • SHA1

    335455c741eea5b6263ee79f46751f3e1b29bc0a

  • SHA256

    0391d5f8055b390f303b4ee164414c09206a558ab6ee99b844126f20877c8c03

  • SHA512

    55a0d7958003d8584bf2159732a21677a40c86bfd08a90f8860cc5c4dbef7bce079ee420c9c99db9797297301dbf8ee0fe85b745b39deae84c709748e3c5df65

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0391d5f8055b390f303b4ee164414c09206a558ab6ee99b844126f20877c8c03

    • Size

      150KB

    • MD5

      fa5cc5f6b2591ba50d8b3d63d36b94ef

    • SHA1

      335455c741eea5b6263ee79f46751f3e1b29bc0a

    • SHA256

      0391d5f8055b390f303b4ee164414c09206a558ab6ee99b844126f20877c8c03

    • SHA512

      55a0d7958003d8584bf2159732a21677a40c86bfd08a90f8860cc5c4dbef7bce079ee420c9c99db9797297301dbf8ee0fe85b745b39deae84c709748e3c5df65

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks