Overview

overview

10

Static

static

177322589e...f6.exe

windows7_x64

10

177322589e...f6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    177322589e89ffc0c435bd665cd3b0e131c2e0cbbd45a5d069046e7336ba5df6

  • Size

    60KB

  • Sample

    220212-d292rsfea8

  • MD5

    3086b03eabb93dfa6a07d41760dee729

  • SHA1

    8a216429778cd750f3c775da80fb69fc64b8d5b3

  • SHA256

    177322589e89ffc0c435bd665cd3b0e131c2e0cbbd45a5d069046e7336ba5df6

  • SHA512

    1f16200c606f7503fd3e16981c53be675e5574d591606f4db94c0cd1947cee56dbee34d4999c4c3b52c95e03af6b426a13eed3173ba9e1109bccf6e6772fc1a2

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      177322589e89ffc0c435bd665cd3b0e131c2e0cbbd45a5d069046e7336ba5df6

    • Size

      60KB

    • MD5

      3086b03eabb93dfa6a07d41760dee729

    • SHA1

      8a216429778cd750f3c775da80fb69fc64b8d5b3

    • SHA256

      177322589e89ffc0c435bd665cd3b0e131c2e0cbbd45a5d069046e7336ba5df6

    • SHA512

      1f16200c606f7503fd3e16981c53be675e5574d591606f4db94c0cd1947cee56dbee34d4999c4c3b52c95e03af6b426a13eed3173ba9e1109bccf6e6772fc1a2

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks