General
-
Target
9d640e603feb1d0308c5fcf56ecc8f10b14ac1ed3c15eea005b8fb2cbce9e573
-
Size
308KB
-
Sample
220604-ygr1nshbhm
-
MD5
0e339a3a434eb8917b71439407f28672
-
SHA1
de006cc0375cbfc5ba04782ca5f3c8e0a6c05961
-
SHA256
9d640e603feb1d0308c5fcf56ecc8f10b14ac1ed3c15eea005b8fb2cbce9e573
-
SHA512
f9ddc2c09e25cef3733efb577d0ba81b106cc4e0015c21861597983681632b32e89acb27b4dc9fe7370d45950589c97935617ba4b79461f6890d28f1ca16a008
Static task
static1
Behavioral task
behavioral1
Sample
9d640e603feb1d0308c5fcf56ecc8f10b14ac1ed3c15eea005b8fb2cbce9e573.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9d640e603feb1d0308c5fcf56ecc8f10b14ac1ed3c15eea005b8fb2cbce9e573.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
9d640e603feb1d0308c5fcf56ecc8f10b14ac1ed3c15eea005b8fb2cbce9e573
-
Size
308KB
-
MD5
0e339a3a434eb8917b71439407f28672
-
SHA1
de006cc0375cbfc5ba04782ca5f3c8e0a6c05961
-
SHA256
9d640e603feb1d0308c5fcf56ecc8f10b14ac1ed3c15eea005b8fb2cbce9e573
-
SHA512
f9ddc2c09e25cef3733efb577d0ba81b106cc4e0015c21861597983681632b32e89acb27b4dc9fe7370d45950589c97935617ba4b79461f6890d28f1ca16a008
Score10/10-
Sakula Payload
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-