MALICIOUS — 965ec137973b7513f9362c21f46962718a35ccbffe851309ffadc2de520d5258

MALICIOUS — 965ec137973b7513f9362c21f46962718a35ccbffe851309ffadc2de520d5258 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the SakulaRAT family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 965ec137973b7513f9362c21f46962718a35ccbffe851309ffadc2de520d5258
SHA-1: 36e905d2bcf9999aa3844405d342ed81967b5104
MD5: 4e39ab5e9c99743202d9a723ffa1ca66
imphash: b7670166af90c993c2ff1ea92345ad6a
ssdeep: 1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrrxq:i0hpgz6xGhZamyF30B3xq
TLSH: T12B3B7D994306A78AFBB6D7276C851E4E0093E4FD80BD35480AC3D63E77D2853A97105E
Submitted as: 965ec137973b7513f9362c21f46962718a35ccbffe851309ffadc2de520d5258
File type: pe · Size: 103424 bytes
Verdict: malicious (100/100) · Family: SakulaRAT

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Visual C/C++
ClamAV (daily): Win.Dropper.Tinba-9943147-2
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Visual C/C++
Microsoft Defender: Trojan:Win32/Sakurel!pz
Trellix Stinger (McAfee): SakulaRAT-FUJM!4E39AB5E9C99
Kaspersky (KVRT): Trojan.Win32.Scar.okdf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Dropper.Tinba-9943147-2 (rule Win.Dropper.Tinba-9943147-2) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Sakurel!pz (rule Trojan:Win32/Sakurel!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged SakulaRAT-FUJM!4E39AB5E9C99 (rule SakulaRAT-FUJM!4E39AB5E9C99) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Scar.okdf (rule Trojan.Win32.Scar.okdf) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Visual C/C++ (rule DIE:Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Visual C/C++ (rule Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Visual C/C++ - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

8050 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\MicroMedia\MediaCenter.exe - 219cc31952e281f5459ac5101e00b16ce92a12c53e1d4c0d8d32bc80552315d6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

citrix.vipreclod.com

Embedded IP addresses

20.184.175.2
4.144.132.223
52.123.252.225
4.230.171.124
57.154.63.210
52.110.12.53
52.110.12.48
184.22.175.13
172.178.240.163
172.215.188.232
72.153.5.136
52.148.114.188
52.110.12.21
52.110.12.45

More SakulaRAT samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report