Overview

overview

10

Static

static

10

176cb12ae1...fe.exe

windows7_x64

10

176cb12ae1...fe.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    176cb12ae151e140a521027d12d70ce6aa7e1b31d84f6d1c1cba8b3c5ec284fe

  • Size

    100KB

  • Sample

    220212-d3jwzafeb4

  • MD5

    3c5953fdfe3d91e4da0087deb0deb320

  • SHA1

    6f79b0d622194cd4f4a777e06aa72d9c0382844f

  • SHA256

    176cb12ae151e140a521027d12d70ce6aa7e1b31d84f6d1c1cba8b3c5ec284fe

  • SHA512

    28ff291228319aaa1607066ebdc7ca816114eeb0be2b248f979682360c2d5b1dd3194896bc3516969c159a3edc2b5f5510514e3e10e341a78b036f7f80e15b3f

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      176cb12ae151e140a521027d12d70ce6aa7e1b31d84f6d1c1cba8b3c5ec284fe

    • Size

      100KB

    • MD5

      3c5953fdfe3d91e4da0087deb0deb320

    • SHA1

      6f79b0d622194cd4f4a777e06aa72d9c0382844f

    • SHA256

      176cb12ae151e140a521027d12d70ce6aa7e1b31d84f6d1c1cba8b3c5ec284fe

    • SHA512

      28ff291228319aaa1607066ebdc7ca816114eeb0be2b248f979682360c2d5b1dd3194896bc3516969c159a3edc2b5f5510514e3e10e341a78b036f7f80e15b3f

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks