Overview

overview

10

Static

static

179039fdee...c6.exe

windows7_x64

10

179039fdee...c6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    179039fdeee5bfa22e35e53e3a81fd4599f8de237a43760fdd78cc149f823ac6

  • Size

    58KB

  • Sample

    220212-d1keqahacl

  • MD5

    67c066c2ddb9d397d78a1950e2e00665

  • SHA1

    465387fc645498f241f4299b3814971efced1356

  • SHA256

    179039fdeee5bfa22e35e53e3a81fd4599f8de237a43760fdd78cc149f823ac6

  • SHA512

    142e88c1712386a2f03a7ee669d423aeeb3e84dab2fd266378b9d5deef66d237df684af720dd4248d5165d5a5b96f525b483da9af2e0b3bc30b48ac0d79f24a8

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      179039fdeee5bfa22e35e53e3a81fd4599f8de237a43760fdd78cc149f823ac6

    • Size

      58KB

    • MD5

      67c066c2ddb9d397d78a1950e2e00665

    • SHA1

      465387fc645498f241f4299b3814971efced1356

    • SHA256

      179039fdeee5bfa22e35e53e3a81fd4599f8de237a43760fdd78cc149f823ac6

    • SHA512

      142e88c1712386a2f03a7ee669d423aeeb3e84dab2fd266378b9d5deef66d237df684af720dd4248d5165d5a5b96f525b483da9af2e0b3bc30b48ac0d79f24a8

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks