Overview

overview

10

Static

static

10

0b2e22c989...87.exe

windows7_x64

10

0b2e22c989...87.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b2e22c989efa2ab94cab7e9aaf1c6f075929a7a900bad0bd111b56d0d2a1387

  • Size

    216KB

  • Sample

    220530-ekxwjshcbq

  • MD5

    a8eb83d3611cbaff46a41b4b7d139a0c

  • SHA1

    233016312b3378bd0ef50bb3757119fcb68d4f43

  • SHA256

    0b2e22c989efa2ab94cab7e9aaf1c6f075929a7a900bad0bd111b56d0d2a1387

  • SHA512

    3771dc08133f709e2e0d4ce440d8b0b029c28c2f6114f437f62d0d9290a25fd7e225c1974a1748d1cb3fdb47345f27e37794840b1103b25f585f863e2db69df4

Score
10/10
sakulapersistenceratsuricatatrojanupx

Malware Config

Targets

    • Target

      0b2e22c989efa2ab94cab7e9aaf1c6f075929a7a900bad0bd111b56d0d2a1387

    • Size

      216KB

    • MD5

      a8eb83d3611cbaff46a41b4b7d139a0c

    • SHA1

      233016312b3378bd0ef50bb3757119fcb68d4f43

    • SHA256

      0b2e22c989efa2ab94cab7e9aaf1c6f075929a7a900bad0bd111b56d0d2a1387

    • SHA512

      3771dc08133f709e2e0d4ce440d8b0b029c28c2f6114f437f62d0d9290a25fd7e225c1974a1748d1cb3fdb47345f27e37794840b1103b25f585f863e2db69df4

    Score
    10/10
    sakulapersistenceratsuricatatrojanupx

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks