Overview

overview

10

Static

static

8d168092d5...e9.exe

windows7_x64

10

8d168092d5...e9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9

  • Size

    496KB

  • Sample

    220122-bvb52sggf2

  • MD5

    98721c78dfbf8a45d152a888c804427c

  • SHA1

    e8d06bd24e600f95b67786db6ff37da1c8995854

  • SHA256

    8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9

  • SHA512

    5f5bf474744c715965a3fff72d5091cec45196b4c2afe44c3ae0e54e08a5a5b8c34494501961b6f2bdfa1a74f9d0b8990b09547beb34e8604ab735b944c15296

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9

    • Size

      496KB

    • MD5

      98721c78dfbf8a45d152a888c804427c

    • SHA1

      e8d06bd24e600f95b67786db6ff37da1c8995854

    • SHA256

      8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9

    • SHA512

      5f5bf474744c715965a3fff72d5091cec45196b4c2afe44c3ae0e54e08a5a5b8c34494501961b6f2bdfa1a74f9d0b8990b09547beb34e8604ab735b944c15296

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks