Overview

overview

10

Static

static

10

af6c0a1949...eb.exe

windows7_x64

10

af6c0a1949...eb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af6c0a194927e589cd5b99c54cd6b7f287aee2944fdf4e11e734242719a05deb

  • Size

    332KB

  • Sample

    220626-cbvnqaeeh9

  • MD5

    36a394bb4967fe95454237d33f1e40cc

  • SHA1

    e623ae5c006b7906373d38bcdfd4913fe1ac2e25

  • SHA256

    af6c0a194927e589cd5b99c54cd6b7f287aee2944fdf4e11e734242719a05deb

  • SHA512

    579e85e2adbc555b7fb29a42b35f424575b551078ba75d62f5a934032ea2df74e346039f6c6f2e1d1727beedf7d9a00604347d70840358eab72d4e813bcbdde0

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Targets

    • Target

      af6c0a194927e589cd5b99c54cd6b7f287aee2944fdf4e11e734242719a05deb

    • Size

      332KB

    • MD5

      36a394bb4967fe95454237d33f1e40cc

    • SHA1

      e623ae5c006b7906373d38bcdfd4913fe1ac2e25

    • SHA256

      af6c0a194927e589cd5b99c54cd6b7f287aee2944fdf4e11e734242719a05deb

    • SHA512

      579e85e2adbc555b7fb29a42b35f424575b551078ba75d62f5a934032ea2df74e346039f6c6f2e1d1727beedf7d9a00604347d70840358eab72d4e813bcbdde0

    Score
    10/10
    sakulapersistenceratsuricatatrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata: ET MALWARE SUSPICIOUS UA (iexplore)

      suricata

    • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks