Overview

overview

10

Static

static

10

0058b20683...22.exe

windows7_x64

10

0058b20683...22.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0058b20683304f0879571f99448f997700896c627e1aaaeb26f0c3a535d34322

  • Size

    92KB

  • Sample

    220212-p19v6aebhr

  • MD5

    84946bbc703130525d6ce4e12f6d70d9

  • SHA1

    74942d38fcd15cd17e0cc1b63b3e45ee83a8b587

  • SHA256

    0058b20683304f0879571f99448f997700896c627e1aaaeb26f0c3a535d34322

  • SHA512

    f4721e90c092bcadc682abf85b5989c4cd0e8947a4edcfec34f1e666e41f6f39f7fcc58592466e09853d13409731f50542cc47fbab91a0f930022916d0b15a51

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      0058b20683304f0879571f99448f997700896c627e1aaaeb26f0c3a535d34322

    • Size

      92KB

    • MD5

      84946bbc703130525d6ce4e12f6d70d9

    • SHA1

      74942d38fcd15cd17e0cc1b63b3e45ee83a8b587

    • SHA256

      0058b20683304f0879571f99448f997700896c627e1aaaeb26f0c3a535d34322

    • SHA512

      f4721e90c092bcadc682abf85b5989c4cd0e8947a4edcfec34f1e666e41f6f39f7fcc58592466e09853d13409731f50542cc47fbab91a0f930022916d0b15a51

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks